AL-  !•  2^S 
J&  d- 


AUDITOR 

GENERAL 
Alberta 


A GEI 

A/ 


'OR 
RAL  W 


Report  of  the  Auditor 
General  of  Alberta 


April  2011 


ISSN  1704-2313 


AUDITOR 

GENERAL 

Alberta 


A GEf 

L 


OR 
RAL  V 


Mr.  Len  Mitzel,  MLA 
Chair 

Standing  Committee  on  Legislative  Offices 

I am  honoured  to  send  my  Report  of  the  Auditor  General  of  Alberta — April  2011  to  Members  of  the 
Legislative  Assembly,  as  required  by  section  20(1)  of  the  Auditor  General  Act. 

Af ■ TXXjey" 

Merwan  N.  Saher,  CA 
Auditor  General 

Edmonton,  Alberta 
April  4,  2011 


Digitized  by  the  Internet  Archive 

in  2013 


http://archive.org/details/repaudalbapr2011 


Introduction 

Message  from  the  Auditor  General 7 

Recommendation  Highlights 9 

April  2011  Recommendations 11 


Systems  Audits 

New  Audit 

Finance  and  Enterprise 

Oversight  of  Credit  Unions — Credit  Union  Deposit  Guarantee  Corporation 15 

Follow-up  Audits 
Cross-Ministry 


IT  Project  Management 21 

Energy 

Assurance  Over  Royalty  Data — Department  of  Energy 23 

Assurance  Systems  for  Volumetric  Accuracy — Energy  Resources  Conservation 

Board 27 

Royalty  Review  Systems — Department  of  Energy 31 

Finance  and  Enterprise 

Enterprise  Risk  Management — Alberta  Treasury  Branches 41 

Treasury  Management — Alberta  Treasury  Branches 43 

Municipal  Affairs 

ME  first!  program — Department  of  Municipal  Affairs 53 

Sustainable  Resource  Development 

Confined  Feeding  Operations — Natural  Resources  Conservation  Board 55 

Contract  for  a Province-Wide  Forestry  Radio  System — Department  of  Sustainable 

Resource  Development 61 

Project  Management  for  Contracts — Department  of  Sustainable  Resource 
Development 61 


Reforestation — Seed  Inventory — Department  of  Sustainable  Resource  Development  ...62 

Financial  Statement  Audits  and  Other  Assurance  Work 


Advanced  Education  and  Technology 65 

Past  Recommendations 

Outstanding  Recommendations 87 

Reference 

Glossary 119 

Index 123 


Report  of  the  Auditor  General  of  Alberta 


April  2011 


4 


Report  of  the  Auditor  General  of  Alberta 


April  2011 


AUDITOR 
GENERAL 
Alberta 


d GEf 

D 


OR 
RAL  W 


Introduction 


Report  of  the  Auditor  General  of  Alberta — April  2011 


Message  from  the  Auditor  General 


Report  highlights 

This  first  report  in  2011  makes  public  our  continued  emphasis  on  following  up  implementation  of  prior 
recommendations.  Up  to  and  including  our  October  2010  Report , our  assessments  of  management 
control  systems,  as  part  of  our  financial  statement  audits,  and  our  stand-alone  systems  audits  resulted  in 
308  outstanding  recommendations.  That  number  is  now  280,  not  including  the  11  new  recommendations 
in  this  report.  Verifying  that  recommendations  have  been  successfully  implemented  is  important  because 
the  benefit  of  our  work  can  only  be  demonstrated  when  we  can  confirm  implementation  to  Members  of 
the  Legislative  Assembly.  We  will  continue  to  work  through  outstanding  recommendations  in  the  coming 
months — applying  the  same  rigor  that  we  apply  to  all  our  audit  work — to  ensure  that  positive  change  in 
government  operations  continues. 

Credit  Union  Deposit  Guarantee  Corporation — A new  systems  audit  (page  15)  found  that  the 
Corporation  has  effective  oversight  systems  to  identify,  monitor  and  respond  to  risks  within  Alberta’s  credit 
unions.  This  is  good  news  and  especially  so  in  uncertain  financial  times.  Alberta  has  46  credit  unions  that 
hold  $16  billion  in  deposits,  which  are  guaranteed  by  the  Corporation.  We  make  no  recommendations  for 
improvement. 

Alberta  Treasury  Branches — In  a follow-up  of  a 2008  systems  audit  (page  41 ),  we  assessed  ATB’s 
progress  implementing  12  of  15  recommendations.  ATB  has  made  good  progress,  having  implemented 
six  of  the  original  recommendations.  We  were  not  satisfied  with  ATB’s  progress  with  interest  rate  risk 
modeling,  so  we  have  repeated  our  recommendation  to  do  with  the  assumptions  used  in  the  models 
(Recommendation  no.  1 — page  48). 

Natural  Resources  Conservation  Board — In  a follow-up  of  a 2004  systems  audit,  we  assessed  the 
Board’s  progress  in  monitoring  confined  feeding  operations.  We  are  now  satisfied  with  systems  that  deal 
with  risks  to  groundwater.  We  are  not  yet  satisfied  that  the  Board's  approach  to  surface  water  risks  is 
adequate,  so  have  made  a specific  recommendation  on  this  matter  (Recommendation  no.  2 — page  59). 

Energy — Albertans  need  to  know  that  royalties  calculated  under  the  existing  royalty  regime  are  based  on 
complete  and  accurate  data.  Our  follow-up  audits  of  the  systems  that  provide  assurance  over  collecting 
and  recording  industry  data  in  the  Department  of  Energy  and  the  Energy  Resources  Conservation  Board 
are  now  completed  and  we  report  that  previous  recommendations  have  been  implemented  (page  23 
and  page  27). 

A systems  audit  in  2007  examined  the  Department’s  systems  for  royalty  review  and  we  made 

five  recommendations  on  how  royalty  regimes  are  described,  reviewed,  measured  and  publicly  reported. 

In  our  follow-up  audit,  we  have  concluded  that  all  recommendations  have  been  implemented,  with  one 
exception.  The  Department  has  improved  performance  measures  for  conventional  oil  and  natural  gas 
royalties  but  has  not  yet  developed  performance  measures  for  the  oil  sands  royalty  regime  (page  31). 

Advanced  Education  and  Technology — Starting  on  page  65,  we  present  the  results  of  new  audits 
and  follow-up  work  at  Alberta’s  universities,  colleges  and  technical  institutes.  We  report  under  three  broad 
themes:  improve  periodic  and  year-end  financial  reporting;  improve  internal  control  systems;  and  preserve 
endowment  assets.  We  also  provide  a progress  report  on  the  Department’s  actions  for  improving 
enterprise  risk  management  systems  in  the  sector. 
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Message  from  the  Auditor  General 


We  have  made  14  recommendations,  of  which  four  are  repeated  because  of  limited  progress  toward 
implementation  The  repeated  recommendation  (no  3 — page  75)  to  Grant  MacEwan  University  is  because 
the  University  is  unable  to  demonstrate  that  it  is  managing  the  risks  that  arise  from  starting  projects  without 
the  protection  that  contracts  provide 

Acknowledgement  and  thanks 

Members  of  the  Legislative  Assembly,  in  particular  members  of  the  Standing  Committee  on  Public  Accounts 
help  us  to  identify  issues  that  are  important  to  legislators  I also  thank  the  members  of  the  Provincial  Audit 
Committee  for  their  advice  Their  expertise  in  financial,  business  and  governance  matters  is  appreciated 
Management  and  staff  of  the  organizations  we  audit  continue  to  cooperate  fully  and  professionally  to  enable 
us  to  do  our  work 

Our  vision  is  to  add  value  through  expert  auditing  I thank  every  member  of  the  Office  Their  teamwork  made 
this  report  possible 

Atefviu,  Af-  'GJvj 

Merwan  N.  Saher,  CA 
Auditor  General 

April  4.  2011 
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Recommendation  Highlights 


This  report  contains  11  new  recommendations  and  five  repeated  recommendations,  all  listed  starting 
at  page  11.  The  five  repeated  recommendations  were  made  because  in  our  judgement,  taking  into 
account  the  complexity  of  the  matter  and  the  action  planned  by  management,  progress  was  insufficient. 
We  have  numbered  three  of  the  16  recommendations  that  need  a formal  response  from  the  government. 

Prioritizing  our  recommendations 

As  part  of  the  audit  process,  we  provide  recommendations  to  government  in  documents  called 
management  letters.  We  use  public  reporting  to  bring  our  recommendations  to  the  attention  of  Members 
of  the  Legislative  Assembly  (MLAs).  For  example,  members  of  the  all-party  Standing  Committee  on  Public 
Accounts  refer  to  the  recommendations  in  our  public  reports  during  their  meetings  with  representatives  of 
government  departments  and  agencies. 

To  help  MLAs,  we  prioritize  recommendations  in  our  public  reports  to  indicate  where  we  believe  they 
should  focus  their  attention.  We  categorize  them  as  follows: 

• Numbered  recommendations — These  recommendations  require  a formal  public  response  from  the 
government.  By  implementing  these  recommendations,  the  government  will  significantly  improve  the 
safety  and  welfare  of  Albertans,  the  security  and  use  of  the  province's  resources,  or  the  governance 
and  ethics  with  which  government  operations  are  managed.  The  most  significant  numbered 
recommendations  are  also  categorized  as  “key.” 

• Unnumbered  recommendations — These  recommendations  are  important  but  do  not  require  a 
formal  public  response  from  government.  The  recipient  of  the  recommendation  has  responded  to  us 
during  the  audit  process. 

Reporting  the  status  of  recommendations 

We  follow  up  all  recommendations  and  report  their  status  in  our  public  reports.  The  timing  of  our 
follow-up  audits  depends  on  the  nature  of  our  recommendations.  To  encourage  timely  implementation, 
and  assist  with  the  timing  of  our  follow-up  audits,  we  require  a reasonable  implementation  timeline  on 
all  recommendations  accepted  by  the  government  or  the  entities  we  audit  that  report  to  the  government. 
We  recognize  some  recommendations  will  take  longer  to  fully  implement  than  others,  but  we  encourage 
full  implementation  within  three  years.  Typically,  we  do  not  report  on  the  progress  of  an  outstanding 
recommendation  until  management  has  had  sufficient  time  to  implement  the  recommendation  and  we 
have  completed  our  follow-up  audit  work.  We  repeat  a recommendation  if  we  find  that  the  implementation 
progress  has  been  too  slow. 

We  report  the  status  of  our  recommendations  as: 

• Changed  circumstances — If  the  recommendation  is  no  longer  valid,  we  explain  why  and  remove 
the  recommendation  from  our  outstanding  recommendation  list. 

• Implemented — We  explain  how  the  government  implemented  the  recommendation. 

• Satisfactory  progress — We  may  state  that  progress  is  satisfactory  based  on  the  results  of  a 
follow-up  audit. 

• Progress  report — Although  the  recommendation  is  not  fully  implemented,  we  provide  information 
when  we  consider  it  useful  for  MLAs  to  understand  management's  actions. 

• Repeated — We  explain  why  we  are  repeating  the  recommendation  and  what  the  government  must 
still  do  to  implement  it. 
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Outstanding  recommendations 

We  have  a chapter  called  Outstanding  Recommendations— see  page  87  It  provides  a complete  list  of 
the  recommendations  that  are  not  yet  implemented  Although  management  may  consider  some  of  these 
recommendations  to  have  been  implemented,  we  do  not  remove  recommendations  from  this  list  until  we 
have  completed  follow-up  audit  work  to  confirm  implementation 
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April  2011  Recommendations 


Green  print — Numbered  recommendation 

Black  print — Unnumbered  recommendation 


Systems  Audits — Foilow-up 


Finance  and  Enterprise — Alberta  Treasury  Branches — 

Treasury  Management 

Page  48  Alberta  Treasury  Branches — Interest  rate  risk  model  assumptions — Recommendation 
No.  1 — Repeated 

We  again  recommend  that  Alberta  Treasury  Branches  improve  processes  for  creating,  applying  and 
validating  assumptions  used  in  its  interest  rate  risk  models. 

Sustainable  Resource  Development — Natural  Resources 
Conservation  Board — Confined  Feeding  Operations 

Page  59  Natural  Resources  Conservation  Board — Surface  water  risks — Recommendation  No.  2 

We  recommend  that  the  Natural  Resources  Conservation  Board  demonstrate  that  its  compliance 
approach  is  adequate  in  proactively  managing  surface  water  risks. 


Financial  Statement  Audits  and  Other  Assurance  Work 


Advanced  Education  and  Technology 

Page  68  Portage  College — Improve  periodic  financial  reporting — Recommendation — Repeated 

We  again  recommend  that  Portage  College  improve  financial  reporting  to  its  board  and  senior 
management  by  providing — at  least  quarterly — complete  statements  of  financial  position  and  actual 
year-to-date  operating  results. 

Page  68  Olds  College — Improve  periodic  financial  reporting — Recommendation 

We  recommend  that  Olds  College  improve  its  processes  and  controls  over  year-end  financial 
reporting. 

Page  71  Alberta  College  of  Art  and  Design — Professional  development  fund — Recommendation 

We  recommend  that  Alberta  College  of  Art  and  Design  establish  policies  and  guidelines  for  the 
management  of  its  professional  development  fund. 

Page  72  Alberta  College  of  Art  and  Design — Code  of  conduct,  conflict  of  interest  and  fraud 
policies — Recommendation 

We  recommend  that  Alberta  College  of  Art  and  Design: 

• develop,  implement  and  enforce  policies  for  code  of  conduct  and  conflict  of  interest 

• develop  and  implement  a fraud  policy  that  clearly  defines  actions,  responsibilities,  authority 
levels  and  reporting  lines  in  case  of  fraud  allegations 

Page  73  Alberta  College  of  Art  and  Design — Controls  over  extended  studies  program — 
Recommendation 

We  recommend  that  Alberta  College  of  Art  and  Design  improve  its  processes  for  the  set-up  and 
approval  of  fees  and  courses  delivered  under  the  extended  studies  program. 

Page  73  Alberta  College  of  Art  and  Design — Controls  over  vendor  master  file  set-up  and 
maintenance — Recommendation 

We  recommend  that  Alberta  College  of  Art  and  Design  improve  its  controls  over  the  set-up, 
maintenance  and  monitoring  of  its  vendor  master  list. 

Page  75  Grant  MacEwan  University — Ensure  contracts  are  signed  before  work  begins — 
Recommendation  No.  3 — Repeated 

We  again  recommend  that  Grant  MacEwan  University  have  signed  contracts  (interim  or  final)  in 
place  before  projects  start. 
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Page  77  Keyano  College — Access  controls  to  key  financial  systems — Recommendation 

We  recommend  that  Keyano  College  improve  access  control  policies  and  processes  for  its 
information  systems  to  ensure  that 

• user  access  to  networks  and  application  systems  is  disabled  when  employees  leave  their 
employment 

• user  access  to  computer  networks  and  systems  is  properly  authorized  and  all  staff  and 
contractors  comply  with  the  computer  use  policy 

Page  78  Keyano  College — Monitor  access  to  key  financial  systems — Recommendation 

We  recommend  that  Keyano  College  develop  a policy  and  processes  for  monitoring  and 
investigating  breaches  of  security  to  its  information  systems 

Page  79  Lakeland  College — Improve  controls  for  staff  to  formally  acknowledge  code  of 
conduct — Recommendation 

We  recommend  that  Lakeland  College  enhance  its  code  of  conduct  processes  and  require  all 
employees  to  reconfirm  compliance  with  the  code  of  conduct  regularly 

Page  79  Lakeland  College — Payroll  controls — Recommendation — Repeated 

We  again  recommend  that  Lakeland  College  adequately  segregate  access  to  the  PeopleSoft  payroll 
system  We  also  recommend  that  management  review  change  reports  generated  from  the  payroll 
system  for  appropriateness. 


Page  80  Medicine  Hat  College — Controls  over  cash  and  accounts  receivable — Recommendation 

We  recommend  that  Medicine  Hat  College  improve  controls  over  cash  accounts  receivable  and 
accounts  receivable  write-offs  related  to  tuition  by 

• adequately  segregating  incompatible  functions  of  preparing  daily  cash  receipts  processing 
accounts  receivable  and  writing  off  accounts  receivable 

• requiring  registration  clerks  to  use  cash  count  sheets  for  controlling  cash  handling  and 
reconciling  cash  handovers  to  the  student  accounts  clerk 

Page  81  Olds  College — Improve  internal  controls — Recommendation — Repeated 

We  again  recommend  that  Olds  College  improve  internal  controls  in  the  bookstore  relating  to  sales 
and  inventories 


Page  82  Portage  College — Improve  controls  over  bookstore  inventory — Recommendation 

We  recommend  that  Portage  College  improve  the  accuracy  of  its  perpetual  inventory  system  at  the 
bookstore 
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Systems  Audits — New 

Report  of  the  Auditor  General  of  Alberta — April  2011 


Oversight  of  Credit  Unions 


Summary 


What  we  examined 

Our  audit  objective  was  to  assess  whether  the 
Credit  Union  Deposit  Guarantee  Corporation  has 
effective  oversight  systems  to  identify,  monitor 
and  respond  to  risks  within  Alberta’s  credit  unions 
that  could  have  an  adverse  impact  on  the  deposit 
guarantee  fund.  This  audit  covered  activities 
at  the  Corporation  between  January  2008  and 
October  2010. 

Why  this  is  important  to  Albertans 

The  primary  purpose  of  the  Corporation  is  to 
guarantee  the  repayment  of  all  deposits  with 
Alberta  credit  unions,  including  accrued  interest. 
The  Credit  Union  AcV  provides  that  the  province 
of  Alberta  will  ensure  that  this  obligation  of  the 
Corporation  is  carried  out.2  The  government’s 
guarantee  is  a significant  financial  risk  if  these 
entities  are  not  operated  in  a safe  and  sound 
manner.  Albertans  need  to  know  that  Alberta’s 
credit  unions  are  in  sound  financial  condition, 
are  complying  with  legislative  and  supervisory 
requirements,  and  are  managing  risks.  The 
Corporation  monitors  the  safety  and  soundness  of 
credit  unions  and  protects  depositors  by  intervening 
if  credit  unions  are  taking  unnecessary  risks  with 
members’  deposits. 

What  we  found 

The  Corporation  has  effective  oversight 
systems  to  identify,  monitor  and  respond  to 
risks  within  Alberta’s  credit  unions.  We  make  no 
recommendations  for  improvement. 


Audit  objective  and  scope 


Our  audit  objective  was  to  assess  whether  the 
Corporation  has  adequate  and  effective  oversight 
processes  to  identify,  monitor  and  respond  to  risks 
within  Alberta’s  credit  unions  that  could  have  an 
adverse  impact  on  the  deposit  guarantee  fund. 


1 RSA2000,  c.C-32 

2 Credit  Union  Act,  Section  1 52(9) 


We  examined  the  Corporation's: 

• business  plan,  operational  plans  and  Standards 
of  Sound  Business  and  Financial  Practices 

• relevant  legislation,  regulatory  framework  and 
monitoring  approach 

• risk  assessment  processes 

• off-site  monitoring  systems 

• processes  for  on-site  examinations 

• processes  for  following  up  on  risks  and 
issues  identified  through  its  monitoring  and 
examination  processes 

• reporting  on  results  of  its  work 


Background 


Mandate  of  the  Credit  Union  Deposit 
Guarantee  Corporation 

The  Credit  Union  Act  sets  out  the  regulatory 
framework  that  the  credit  union  system  operates 
within.  The  Minister  of  Finance  and  Enterprise 
is  responsible  for  the  Act.  Alberta’s  credit  union 
system  includes  46  credit  unions,3  the  Corporation 
and  Credit  Union  Central-Alberta  Ltd.  The 
Corporation  administers  significant  aspects  of  the 
Act  on  behalf  of  the  Minister.  The  Corporation’s 
mandate  and  roles  describes  the  roles  and 
responsibilities  of  the  Corporation  and  the  Minister. 

The  Corporation’s  role4  is  to: 

• provide  a 100%  guarantee  of  deposits  held 
with  Alberta  credit  unions 

• regulate  credit  unions  and  enforce  the  Credit 
Union  Act 

• review,  advise  and  direct  on  credit  union 
sound  business  practices 

• monitor  credit  union  performance  and 
implement  appropriate  actions  to  improve 
performance  and  reduce  risks 

• establish  individual  credit  union  loan  approval 
limits  and  provide  an  appropriate  adjudication 
process  for  loans  exceeding  these  limits 


3 See  Table  1 : Summary  of  credit  unions,  page  1 6 

4 Credit  Union  Deposit  Guarantee  Corporation — 2009  Annual 
Report,  page  3 
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Under  the  Act,  the  Corporation  guarantees  the 
repayment  of  all  deposit  principal  and  interest 
by  Alberta  credit  unions  Credit  unions  pay 
the  Corporation  an  annual  deposit  guarantee 
assessment  The  Government  of  Alberta  ensures 
the  Corporation  meets  its  obligations.5  for  the 
deposit  guarantee 

The  Corporation  s regulatory  and  oversight 
objectives  are  to  minimize  the  risk  of  claims  against 
the  deposit  guarantee  fund  and  the  Government  of 
Alberta. 

The  Corporation  maintains  the  deposit  guarantee 
fund,  which  held  $135  million  in  assets  at 
December  1 , 2009,  or  0 85%  of  total  credit  union 
deposits  of  $16  billion.  If  any  guarantee  of  deposits 
beyond  the  fund's  $135  million  was  required,  the 
Government  of  Alberta  is  obliged  to  ensure  that 
the  Corporation  meets  its  obligation  for  the  deposit 
guarantee. 


Credit  union  system 

The  Corporation  reports  the  total  assets  and 
deposits  for  all  credit  unions  and  for  the  five  largest 
credit  unions  in  the  province  as  follows 


Summary  of  credit  union*  ($  in  billions) 


2009 

2008 

2007 

Number  of  credit  unions 

46 

48 

48 

Total  assets 

$17  5 

$16  5 

$14  8 

Total  deposits 

S16  0 

$15  1 

$132 

Table  1 Summary  of  credit  unions  (unaudited  information 
provided  by  the  Corporation) 


Summary  of  the  five  largest  credit  unions  in  Alberta—  1 
October  2009  ($  in  billion*) 

Credit  union 

Total 

Assets 

Total 

Deposits  1 

Servus  Credit  Union 

$102 

$9  4 

First  Calgary  Financial 

$2  3 

$22 

Chinook  Credit  Union 

$0  6 

$05 

Mountain  View  Credit  Union 

$0  5 

$05 

Battle  River  Credit  Union 

$0  5 

$04 

Table  2 Summary  of  largest  credit  unions  (unaudited 
information  provided  by  the  Corporation) 


Overview  of  the  Credit  Union  System 

In  addition  to  credit  unions,  there  are  other  entities  involved  in  the  credit  union  system.  The  following 
diagram  provides  an  overview  of  these  entities  and  the  relationships  between  them 


Department  of  Finance 
and  Enterprise 


Credit  Union  Deposit 
Guarantee  Corporation 


T .. 


Credit  unions 


* 


d J 

Credit  Union 

■H 

Central-Alberta  Ltd. 

Alberta  credit  union 
members 


5 Credit  Union  Act,  Section  152(9) 
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Alberta  credit  unions  generally  provide 
deposit  taking  and  lending  services  to  credit 
union  members. 

The  Corporation  provides  oversight  and 
a guarantee  of  deposits  of  Alberta  credit 
unions.  It  also  provides  adjudication  for 
certain  lending  activities  of  credit  unions. 

The  Corporation  charges  credit  unions 
a deposit  guarantee  assessment  in 
exchange  for  the  100%  deposit  guarantee. 
The  Corporation  is  a provincial  agency 
accountable  to  the  Minister. 

The  Minister  of  Finance  and  Enterprise 
regulates  Alberta  credit  unions  through  the 
Act  and  its  regulations.  The  Minister  has 
a responsibility  to  ensure  the  Corporation 
fulfills  its  responsibilities  under  a mandate 
and  roles  document.  The  Deputy  Minister 
of  Finance  and  Enterprise  sits  on  the 
Corporation’s  Board  of  Directors. 

Credit  Union  Central  Alberta  Ltd.  (CUC-AB) 
is  a corporation  owned  by  Alberta  credit 
unions,  and  acts  as  a trade  association  on 
behalf  of  the  Alberta  credit  union  system. 
CUC-AB  provides  centralized  support 
services  to  Alberta  credit  unions,  such  as 
cheque  processing,  electronic  payments  and 
customer  internet  services.  CUC-AB  also 
serves  as  the  central  banking  facility  and 
liquidity  provider  to  credit  unions — Alberta 
credit  unions  are  required  to  maintain  a 
minimum  level  of  liquidity  with  CUC-AB.6 


The  Corporation  has  no  regulatory  oversight 
of  CUC-AB.  The  Department  of  Finance  and 
Enterprise  performs  this  oversight  function, 
a function  that  we  examined  as  part  of  our 
April  2010  audit  of  the  Department’s  systems 
to  provide  oversight  of  financial  institutions. 
The  Corporation  and  the  Department  recently 
signed  an  information  sharing  agreement  that 


6 Credit  Union  Central-Alberta  Limited  Annual  Report,  2008, 
page  16:  AB  Central's  by-laws  require  Alberta  credit  unions 
to  maintain  a minimum  of  1 % of  their  assets  as  share 
capital  with  AB  Central.  Credit  unions  are  also  required  to 
maintain  liquidity  deposits  at  AB  Central  such  that  their  total 
liquidity  deposits  and  share  capital  held  are  no  less  than 
9%  of  the  credit  union’s  liabilities. 


enables  the  Corporation  to  obtain  information 
related  to  CUC-AB  from  the  Department. 

The  Corporation’s  oversight  role 

The  Corporation’s  credit  and  risk  management 
department  is  primarily  responsible  for  overseeing 
Alberta’s  credit  unions.  The  department  is 
organized  into  three  main  functions: 

• Risk  analytics — Staff  in  risk  analytics  are 
responsible  for  on-site  examinations,  off-site 
monitoring  and  updating  the  risk  profiles  of 
the  credit  union  system.  On-site  examinations 
consist  of  credit  and  operational  reviews  of 
procedures  and  processes  at  individual  credit 
unions.  Off-site  monitoring  is  a review  of 
financial  information  and  information  packages 
provided  to  credit  union  boards  and  board 
committees. 

• Credit — Credit  staff  are  responsible  for 
on-site  examination  support  in  credit  related 
areas,  including  reviewing  and  assessing 
the  effectiveness  of  the  credit  function7  within 
credit  unions.  They  are  also  responsible 

for  adjudicating  certain  loans,  setting  credit 
union  lending  limits,  reviewing  specific  loan 
transactions  and  coaching  credit  unions’ 
lenders. 

• Risk  management — Risk  management 
staff  provide  assistance  and  guidance  with 
sound  business  practices  (as  set  out  in  the 
Corporation’s  Standards  of  Sound  Business 
and  Financial  Practices).  They  also  provide 
on-site  examination  support,  regulatory 
approvals,  intervention  activities  and  complete 
examinations  of  credit  unions  with  less  than 
$100  million  in  assets. 


Findings 


The  Corporation  has  effective  oversight  systems 
to  identify,  monitor  and  respond  to  risks  within 
Alberta’s  credit  unions.  The  Corporation  has 
effective  risk  assessment,  off-site  monitoring  and 
on-site  examination  systems;  good  processes 

7 Includes  reviews  and  assessments  of  the  effectiveness  of 
the  credit  function  in  credit  unions  with  recommendations 
for  improvement. 
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for  reporting  the  results  of  its  work  to  its  board 
of  directors,  credit  unions  and  other  regulatory 
organizations;  and  effective  systems  for  following 
up  on  risks  and  issues  identified  through  its 
monitoring  processes 

The  composition  of  the  credit  union  system  is 
changing,  and  the  Corporation  is  responding 
appropriately  to  these  changes  A major  risk  to  the 
credit  union  system  is  concentration  risk  created 
by  the  mergers  of  three  large  credit  unions  into 
Servus  Credit  Union  This  merger  has  resulted  in 
the  Servus  Credit  Union  holding  approximately 
60%  of  total  credit  union  deposits  in  the  province 

The  Act  requires  credit  unions  to  maintain  a level 
of  capital  that  protects  them  against  unexpected 
losses.  Quarterly,  the  Corporation  monitors  the 
capital  position  of  each  credit  union  against  this 
regulatory  minimum.  The  Corporation  also  monitors 
the  overall  financial  health  of  the  credit  union 
system  and  reviews  individual  financial  results  and 
activities  of  credit  unions  regularly. 

Based  on  these  findings,  we  make  no 
recommendations  for  improvement. 
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Guidance  on  overseeing  information 
technology  projects — implemented 

Background 

In  our  October  2006  Report  (no.  22,  vol.  1 — 
page  174),  we  recommended  the  Deputy  Minister 
of  (then)  Restructuring  and  Government  Efficiency 
(now  the  Department  of  Service  Alberta),  provide 
guidance  to  Deputy  Ministers  and  their  Chief 
Information  Officers  to  promote  effective  project 
management  practices.  In  our  original  audit, 
we  examined  three  major  IT  projects  and  found 
inconsistent  performance  in  achieving  IT  project 
objectives.  We  recommended  that  guidance  be 
provided  to  Deputy  Ministers  and  Chief  Information 
Officers  (CIOs)  on  their  responsibilities  for 
overseeing  IT  projects.  We  noted  that  Deputy 
Ministers  and  CIOs  across  government  play  a key 
role  in  monitoring  and  enforcing  compliance  with 
approved  project  management  practices. 


Our  audit  findings 


Key  Points 


• Project  management  policy  instruments  have  been 
developed 

• Guidance  is  consistent  with  accepted  project 
management  criteria 

• Assessing  implementation  of  the  guidance  is  beyond 
the  scope  of  this  follow-up  and  will  be  done  at  the 
department  level 

The  Department  initiated  a major  change  in  its 
approach  to  the  coordination  of  IT  development 
across  the  Government  of  Alberta  in  July  2008, 
when  Cabinet  approved  the  Government  of 
Alberta  Information  Management  and  Technology 
Strategy.  This  Strategy  presented  a plan  based 
on  a single-enterprise  approach  to  develop  a 
government-wide  framework  for  information 
management  technology  (IMT)  planning, 
governance  and  funding.  A number  of  policy 
instruments  have  been  developed  to  support  this 
strategy,  including  developments  related  to  the 
project  management  component. 

The  following  actions  have  been  taken  by  the 
Department,  through  the  Chief  Information  Officer 

Report  of  the  Auditor 


Council,  to  provide  further  guidance  on  project 
management  over  IT  projects: 

• A project  management  task  force  (PMTF), 
made  up  of  seven  members  of  the  CIO  Council, 
was  established  in  November  2008  to  “develop 
a government-wide  consistent  approach 

for  managing  IMT  projects  and/or  IMT 
enabled  projects  to  increase  the  likelihood 
of  IMT  project  success  and  allow  for  ministry 
flexibility  while  still  meeting  IMT,  ministry  and 
audit  requirements".1  The  PMTF  finalized 
the  following  deliverables  in  March  2010, 
and  made  them  available  to  the  Office  of 
the  Corporate  Chief  Information  Officer  for 
approval: 

• IMT  Project  Management  Framework 

• IMT  Project  Management  Policy  Directive 

• IMT  Project  Management  Guidelines 
(consisting  of  10  separate  guideline 
documents  covering  key  aspects  of  project 
management) 

• The  Department  has  proceeded  with  the  IMT 
Project  Management  Guidelines.  “Guidelines 
provide  information,  advice  or  explanation  to 
assist  in  implementation  of  policy  or  policy 
instruments’’.2  They  are  not  mandatory,  but 
are  tools  available  for  use  by  departments  as 
they  deem  appropriate.  The  content  of  the 
Guidelines  is  consistent  with  accepted  project 
management  standards. 

By  opting  for  guidelines  rather  than  standards, 
the  Department  has  reinforced  the  autonomy  of 
departments  to  develop  the  project  management 
practices  they  feel  are  most  appropriate.  As  such, 
assessing  the  implementation  of  this  guidance 
across  the  departments  of  the  Government  of 
Alberta  is  beyond  the  scope  of  this  follow-up  audit. 
In  future  work,  we  will  assess  whether  departments 
have  implemented  the  project  management 
guidance  and  whether  this  results  in  IT  projects  that 
deliver  expected  results  on  time  and  within  budget. 


1 PMTF,  Terms  of  Reference,  November  2009 

2 Information  Management  and  Technology  Policy  Definition, 
January  14,  2009,  page  6 
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Summary 


The  Department  of  Energy  calculates  oil  and  gas 
royalties  using  data  provided  by  the  industry.  To 
make  sure  producers  pay  all  the  royalties  they 
owe  to  the  province,  the  Department  must  have 
assurance  that  producers  provide  complete  and 
accurate  data  on  their  wells  and  production. 

What  we  examined 

In  2005,  we  audited  systems  that  the  Department 
relied  on  to  ensure  that  data  used  to  calculate 
conventional  oil  and  natural  gas  royalties  are 
complete  and  accurate.  Based  on  our  examination, 
we  recommended  that  the  Department  complete 
a risk  assessment  and  evaluate  the  assurance 
obtained  from  controls  operating  at  the  Department, 
the  Energy  Resources  Conservation  Board  (ERCB) 
and  the  Petroleum  Registry  of  Alberta  (Registry). 
We  also  recommended  that  the  Department 
communicate  how  much  assurance  it  requires  from 
ERCB  over  the  completeness  and  accuracy  of  well 
and  production  data. 

We  last  reported  on  this  audit  and  its  underlying 
recommendation  in  our  October  2007  Report 
(vol.  2 — page  64),  in  which  we  provided  a 
progress  report  on  the  activities  the  Department 
had  undertaken  and  what  remained  outstanding. 
We  highlighted  four  areas  that  had  to  be 
completed  to  implement  the  recommendation: 

• complete  risk  assessments 

• identify  any  significant  residual  risks 

• ensure  that  sources  of  assurance  are 
sustainable 

• ensure  that  audit  findings  can  be  extrapolated 

We  completed  the  2010  follow-up  to  assess  if  the 
Department  has  addressed  the  outstanding  items. 

Why  it  is  important  to  Albertans 

Royalties  from  oil  and  gas  are  a considerable 
portion  of  the  Alberta  government’s  revenue. 

Thus,  effective  systems  to  provide  assurance 
over  well  and  production  data  reported  by 


industry  and  used  in  royalty  calculations  are 
critical.  Albertans  need  to  know  that  royalties 
calculated  under  the  existing  royalty  regime 
are  based  on  complete  and  accurate  data. 

What  we  found 

The  Department  has  fully  implemented  the 
recommendation.  It  completed  risk  assessments, 
identified  residual  risks  and  agreed  on  a required 
and  sustainable  level  of  assurance  with  ERCB. 


Audit  objectives  and  scope 


Our  objective  was  to  determine  if  the  Department 
has  implemented  the  recommendation  originally 
reported  in  our  October  2005  Report 
(no.  28 — page  165).  We  focused  on  the 
Department’s  actions  since  our  2007  progress 
report.  Our  field  work  was  conducted  from 
April  201 0 to  November  2010. 


Background 


The  Department  requires  accurate  and  complete 
data  to  ensure  the  appropriate  calculation  of 
royalties.  Oil  and  gas  producers  are  required  to 
regularly  submit  production  and  well  data  to  the 
Registry.  The  Department  extracts  information 
from  the  Registry  to  perform  royalty  calculations. 
The  Department  obtains  assurance  over  the  data 
reported  by  producers  through  its  own  internal 
controls,  through  control  activities  at  ERCB 
and  through  controls  within  the  Registry.  The 
Department  also  expects  producers  to  have  the 
necessary  processes  to  ensure  compliance  with 
the  measurement  and  reporting  requirements 
stipulated  by  the  Department  and  ERCB. 

In  our  October  2005  Report  (no.  29 — page  169), 
we  recommended  that  ERCB  strengthen 
its  controls  for  verifying  the  accuracy  and 
completeness  of  oil  and  natural  gas  volumetric 
data  and  for  enforcing  measurement  standards. 
Overall,  both  recommendations  were  intended  for 
the  Department  and  ERCB  to  initiate  activities  to 
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support  the  accuracy  of  well  and  production  data 
reporting. 

As  a means  to  achieving  this  objective,  the 
Department  and  ERCB  formed  a joint  volumetric 
steering  committee  in  2006.  The  primary  purpose 
of  this  committee  is  to  establish  the  context, 
expectations  and  monitoring  required  for  the 
assurance  provided  by  the  Department  and  ERCB 
related  to  well  and  production  data.  As  noted 
in  our  progress  report  in  2007,  communication 
between  the  Department  and  ERCB  improved  after 
the  formation  of  this  committee,  and  the  ongoing 
activities  to  implement  the  recommendation  have 
been  largely  derived  from  the  decisions  and  actions 
of  this  committee. 


Findings 


Assurance  on  well  and  production 
data — implemented 

Background 

In  our  October  2005  Report  (no.  28 — page  1 65)  we 
recommended  that  the  Department  of  Energy: 

• complete  its  risk  assessment  and  evaluate 
the  assurance  obtained  from  the  Petroleum 
Registry  System  and  the  Department's  controls 
over  well  and  production  data 

• communicate  to  the  Energy  Resources 
Conservation  Board  how  much  assurance, 
if  any,  the  Department  needs  over  the 
completeness  and  accuracy  of  well  and 
production  data 

In  our  October  2006  Report  (no.  27 — page  76),  we 
repeated  the  above  recommendation  because  the 
Department's  progress  was  slower  than  expected. 

In  our  October  2007  Report  (vol.  2 — page  64),  we 
included  a progress  report  that  outlined  actions 
taken  by  management. 


Our  audit  findings 


Key  Points 


• Risk  assessments  have  been  completed  and  residual 
risks  have  been  identified 

• Systems  for  assurance  over  well  and  production  data 
are  more  sustainable 
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The  Department  has  fully  implemented  the 
recommendation  by  completing  the  outstanding 
actions  identified  during  the  last  follow-up  This 
includes  completing  risk  assessments,  identifying 
residual  risks  and  outlining  mitigating  action  for  data 
types  that  have  a significant  impact  on  royalties 
The  Department  has  also  agreed  on  a required 
and  sustainable  level  of  assurance  with  ERCB 

Complete  risk  assessments 

The  Department  completed  a comprehensive  risk 
assessment  of  the  34  most  significant  data  types 
used  to  determine  royalties.  Data  types  include 
items  such  as  depth  of  a well,  production  hours 
and  the  well  identification  number  The  overall  risk 
rating  for  each  data  type  was  determined  based 
on  an  evaluation  of  the  potential  dollar  impact  on 
the  royalty  calculation  and  the  likelihood  of  an  error 
occurring  before  considering  the  controls  in  place 
to  mitigate  risk.  These  risk  ratings  are  supported 
by  quantitative  and  qualitative  analysis  of  the 
individual  data  types. 

The  Department  updates  the  risk  assessment  as 
required  based  on  factors  such  as  changes  to 
the  relevance  of  a data  type  used  in  the  royalty 
calculation,  new  data  types  that  may  be  required  in 
the  calculation  of  royalties,  and  issues  or  reporting 
errors  identified  for  a particular  data  type 

Identify  significant  residual  risks 

Using  the  risk  assessments,  the  Department 
identified  the  key  controls  for  each  data  type  This 
included  controls  in  place  at  the  Department,  ERCB 
and  the  Registry  After  considering  the  controls  in 
place  to  mitigate  the  risks  of  reporting  errors,  the 
Department  identified  the  remaining,  or  residual 
risk,  and  classified  the  data  types  as  low,  medium 
or  high  risk  For  those  data  types  considered 
medium  or  high  risk,  the  Department  outlined 
specific  mitigating  actions  to  consider  the  risks 

Ensure  assurance  processes  are 
sustainable 

The  Department  and  ERCB  have  agreed  on  the 
level  of  assurance  ERCB  provides  ERCB  outlined 
all  the  processes  where  they  provide  assurance 


Report  of  the  Auditor  General  of  Alberta 


April  2011 


Assurance  Over  Royalty  Data — Follow-up  Audit 


over  well  and  production  data,  and  the  Department 
has  confirmed  that  the  level  of  assurance  provided 
by  ERCB  is  acceptable. 

In  our  2007  progress  report,  we  highlighted  a key 
area  where  the  Department  relies  on  ERCB  to 
provide  assurance  over  the  completeness  and 
accuracy  of  well  and  production  data  reported  by 
producers.  ERCB’s  production  audit  team  assesses 
industry  reports  against  the  measurement 
requirements,  through  compliance  audits. 

To  improve  the  efficiency  of  the  assurance 
provided,  ERCB  is  implementing  an  enhanced 
production  audit  program  (EPAP).  This  new 
approach  to  measurement  and  reporting  is 
designed  to  raise  the  level  of  assurance  over 
compliance  with  ERCB’s  volumetric  measurement 
and  reporting  requirements.  The  EPAP’s  design 
is  also  a more  sustainable  approach  to  providing 
assurance.  It  requires  industry  to  declare  and, 
when  necessary,  prove  that  the  controls  over  the 
well  and  production  data  they  report  to  the  Registry 
are  operating  effectively.  Although  ERCB  will  still 
complete  measurement  compliance  audits,  the 
audits  will  be  selected  primarily  based  on  risk  and 
noncompliance  with  the  requirements  of  the  EPAP. 

Currently,  ERCB,  with  input  from  the  Department, 
is  identifying  the  most  effective  means  to 
regularly  report  the  level  of  assurance  provided 
by  the  operation  of  the  EPAP  and  other  ERCB 
volumetric  data  assurance  activities.  During  the 
implementation  phase  of  the  EPAP,  ERCB  will 
continue  to  report  any  errors  or  issues  identified 
through  their  measurement  compliance  audits. 

Once  the  EPAP  is  fully  implemented,  and  the 
reporting  structure  is  finalized,  we  will  assess  these 
processes. 

Extrapolate  findings 

Assurance  processes  at  the  Department, 

ERCB  and  the  Registry  are  designed  to  identify 
errors  based  on  the  contravention  of  controls. 
Therefore,  the  errors  would  not  necessarily  be 
representative  of  the  population  as  a whole.  The 


focus  of  assurance  activities  is  to  identify  where 
the  highest  risk  of  incorrect  measurement  and 
reporting  exists  and  ensure  that  all  measurement 
and  reporting  deficiencies  are  corrected.  Further, 
measurement  compliance  audits  completed  by 
ERCB  are  conducted  on  operators  that  have  a 
history  of  noncompliance  or  where  the  highest  risk 
of  incorrect  reporting  exists. 
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Summary 


The  Energy  Resources  Conservation  Board 
(ERCB)  is  responsible  for  administering  the  Oil 
and  Gas  Conservation  Act  (Act)1.  The  Act  and  its 
regulations  require  ERCB  to  gather  information 
about  the  volume  of  natural  gas  and  oil  produced 
in  Alberta.  To  make  sure  this  information  is 
accurate,  complete  and  current,  ERCB  develops 
measurement,  accounting  and  reporting  standards 
for  the  oil  and  gas  industry.  Every  month,  the 
industry  provides  volumetric  data  to  ERCB,  through 
the  Petroleum  Registry  of  Alberta  (Registry).  To 
help  ensure  that  this  data  is  accurate,  ERCB 
assesses  whether  producers  are  complying  with  its 
measurement  standards. 

What  we  examined 

In  2005,  we  audited  the  systems  ERCB  uses  to 
ensure  that  it  receives  complete  and  accurate 
volumetric  data  from  the  oil  and  gas  industry,  and 
whether  ERCB’s  level  of  assurance  for  this  data 
meets  the  Department  of  Energy’s  requirements 
for  royalty  calculations.  Based  on  our  examination, 
we  recommended  that  ERCB  explore  ways  to 
strengthen  its  controls  for  ensuring  the  accuracy 
and  completeness  of  oil  and  gas  volumetric  data 
submitted  by  industry. 

We  last  reported  on  this  audit,  and  its  one 
underlying  recommendation,  in  our  October  2007 
Report  (vol.  2 — page  68),  in  which  we  provided  a 
progress  report  on  activities  ERCB  had  undertaken 
and  what  remained  to  be  completed.  We 
highlighted  three  areas  that  had  to  be  completed  to 
fully  implement  the  recommendation.  We  did  this 
follow-up  to  assess  if  ERCB  has  addressed  the 
outstanding  items. 

Why  it  is  important  to  Albertans 

Volumetric  data  is  a key  component  in  the 
Department’s  royalty  calculations.  Royalties  provide 

1 Chapter  0-6,  RSA.  2000 


a significant  portion  of  the  Alberta  government's 
revenue.  Therefore,  it  is  critically  important  that 
ERCB  provide  assurance  that  the  data  used  for 
royalty  calculations  is  complete  and  accurate. 

ERCB  also  uses  volumetric  data  to: 

• assess  the  industry’s  compliance  with 
standards  (e  g.,  regulation  of  flaring/venting) 

• determine  the  province’s  oil  and  natural  gas 
reserves 

• assess  the  industry’s  ability  to  return  wells  and 
facilities  to  a safe  condition  after  production  has 
stopped 

What  we  found 

ERCB  has  fully  implemented  our  recommendation. 

It  has  identified  the  level  of  data  assurance  its 
processes  provide,  assessed  the  sustainability  of 
its  measurement  audit  processes,  and  implemented 
a regular  and  timely  reporting  system. 


Audit  objectives  and  scope 


Our  objective  was  to  determine  if  ERCB  had 
implemented  the  recommendation  originally 
reported  in  our  October  2005  Report  (no.  29 — 
page  169). 

We  conducted  our  field  work  in  November  2010 
and  December  2010,  and  focused  on  ERCB's 
actions  since  our  progress  report  in  2007. 


Findings 


Assurance  systems  for  volumetric 
accuracy — implemented 

Background 

ERCB  conducts  a variety  of  assurance  and  audit 
activities  to  ensure  compliance  with  regulatory 
requirements.  This  includes  audits  to  verify  that 
the  industry  complies  with  measurement  standards 
when  it  reports  volumetric  data.  A large  part  of 
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the  compliance  work  related  to  volumetric  data  is 
conducted  by  ERCB’s  information  collection  and 
dissemination  group  and  its  production  audit  team. 
The  information  collection  and  dissemination 
group’s  primary  activities  include  tracking, 
assessing,  assigning  responsibility  for  and 
communicating  volumetric  data  issues  within  the 
Registry.  In  2007,  we  found  that  these  processes 
were  operating  effectively.  The  production  audit 
team’s  objective  is  also  to  provide  assurance  that 
data  reported  to  the  Registry  is  correct.  Although 
the  Registry  has  numerous  validation  checks  and 
controls,  there  is  still  a risk  that  data  could  be 
reported  incorrectly  within  the  boundaries  of  the 
Registry  controls. 

In  our  October  2005  Report  (no.  29 — page  169), 
we  recommended  that  ERCB  explore  ways  to 
strengthen  controls  for  verifying  the  accuracy  and 
completeness  of  oil  and  natural  gas  volumetric  data 
and  for  enforcing  measurement  standards. 

In  our  October  2007  Report  (page  68),  we 
reported  on  ERCB's  progress  and  identified 
what  was  required  to  finish  implementing  our 
recommendation. 


Our  audit  findings 


Key  Points 


• The  level  of  data  accuracy  assurance  provided  has 
been  identified 

• Sustainability  of  its  measurement  audit  processes  has 
been  assessed 

• A regular  and  timely  reporting  system  has  been 
implemented 

Since  our  last  follow-up,  the  production  audit  team 
has  undergone  a transformation  in  how  it  provides 
assurance  over  volumetric  data.  The  team  has 
developed,  and  is  implementing,  an  enhanced 
production  audit  program  (EPAP).  The  program  is 
designed  to  enhance  the  level  of  assurance  over 
compliance  with  measurement  and  reporting  of 
volumetric  data. 

Set  expected  levels  of  assurance 

ERCB  completed  a comprehensive  review  to 
identify  an  appropriate  level  of  assurance  over  the 
accuracy  and  completeness  of  volumetric  data 
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An  internal  report,  Setting  the  Expected  Level  of 
Assurance  for  Volumetric  Data,  identified  existing 
sources  of  volumetric  data  assurance  and  the 
needs  of  internal  stakeholders  as  the  basis  for 
enhancing  ERCB's  production  audit  program 
ERCB  concluded  that  the  level  of  assurance 
defined  in  the  report 

• aligned  with  ERCB's  mandate 

• was  achievable  within  resource  constraints 

• would  support  the  development  of  an  enhanced 
production  audit  program 

To  facilitate  this  review,  ERCB  established  criteria 
for  setting  the  level  of  accuracy  and  assurance 
required  by  different  groups  within  ERCB  Through 
interviews  with  ERCB  groups  that  use,  produce 
or  verify  volumetric  data,  and  the  identification  of 
business  processes  that  provide  data  assurance. 
ERCB  designed  the  appropriate  level  of  assurance 
for  volumetric  data 

ERCB  then  communicated  the  expected  level  of 
assurance  it  could  provide  to  the  Department  The 
Department  confirmed  that  the  level  of  assurance 
ERCB  provides  would  meet  the  Department's 
assurance  needs 

Sustainability  of  audit  processes 

In  2007,  we  found  that  ERCB's  approach  to 
providing  assurance  over  volumetric  data  was  likely 
not  sustainable.  The  measurement  compliance 
audits  could  not  keep  up  with  industry  activity  and 
reporting.  To  provide  and  sustain  the  expected  level 
of  assurance,  ERCB  began  developing  an  EPAP 

The  EPAP  is  designed  to  enhance  the  level  of 
assurance  over  compliance  with  ERCB's  volumetric 
and  reporting  requirements  ERCB  Directive  076: 
outlines  what  ERCB  expects  of  all  operators  that 
are  subject  to  ERCB  measurement  and  reporting 
requirements  and  that  report  to  the  Registry.  ERCB 
has  planned  a two-year  implementation  timeframe, 
with  2010  as  a trial  declaration  period  and  2011  the 
first  declaration  period 


2 Directive  076,  Operator  Declaration  Regarding 
Measurement  and  Reporting  Requirements 
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A key  objective  of  EPAP  is  to  reduce  reliance  on  are  satisfied  that  all  results  identified  through 

measurement  compliance  audits  in  favour  of  relying  measurement  compliance  audits  are  being 

on  the  effectiveness  of  each  operator's  controls  appropriately  reported  to  the  Department, 

over  measurement  and  reporting  of  volumetric  data. 

The  EPAP  requires  an  operator’s  senior  executives 
to  submit  a signed  declaration,  annually,  stating 
that  their  controls  are  designed  and  implemented 
to  ensure  compliance  with  ERCB  measurement 
and  reporting  requirements.  Because  the  level  of 
assurance  is  being  enhanced  through  the  reliance 
on  operators’  controls,  Directive  076  stipulates  that 
operators  must  annually  evaluate  their  controls 
for  measurement  and  reporting.  Operators  must 
be  able  to  provide  evidence  of  the  results  of 
their  controls  evaluations.  ERCB  also  conducts 
analysis  of  volumetric  reporting  to  identify  any 
unusual  trends  or  anomalies,  and  completes  risk 
assessments  to  better  identify  which  operators  may 
be  examined.  Noncompliance  with  Directive  076 
results  in  an  enforcement  directive  being  applied. 

From  2008  to  the  end  of  2010,  as  EPAP 
implementation  progressed,  ERCB  completed 
measurement  compliance  audits  at  a reduced 
rate.  From  2011  onward,  ERCB  will  focus 
measurement  compliance  audits  on  the 
highest  risk  operators  and  areas  of  volumetric 
reporting,  and  overall  assurance  over  volumetric 
data  should  be  improved  through  EPAP. 

Regular  and  timely  reporting 

A memorandum  of  understanding  between  ERCB 
and  the  Department  stipulates  that  ERCB  is 
expected  to  provide  regular  and  timely  reporting 
on  audit  results.  Currently,  ERCB  reports  quarterly 
on  all  the  errors  identified  through  its  measurement 
compliance  audits.  We  reviewed  the  reports  ERCB 
submitted  to  the  Department  in  2009  and  2010. 

The  results  indicated  only  minor  differences 
between  volumes  reported  to  the  Registry  and 
actual  volumes  recorded  at  the  facilities. 

ERCB  expects  its  reporting  structure  will 
change  to  incorporate  the  additional  information 
the  EPAP  will  provide.  As  part  of  a future 
examination  of  ERCB’s  EPAP,  we  will  assess 
the  finalized  reporting  structure.  At  this  time,  we 
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Summary 


The  Department  of  Energy  charges  royalties 
on  production  of  Crown-owned  hydrocarbon 
resources.  The  Minister  of  Energy  is  responsible 
for  setting  and  adjusting  royalties  for  hydrocarbon 
production.  The  Department  provides  the  Minister 
with  analysis  to  support  royalty  policy  decisions, 
and  then  implements  the  royalty  regimes.  Natural 
gas,  oil  sands  and  conventional  oil  all  have 
differing  royalty  rates,  programs  and  structures; 
thus,  Alberta  does  not  have  a single  royalty 
regime,  but  rather  a series  of  royalty  regimes. 

Alberta’s  oil  and  gas  industry  changes  continuously, 
in  response  to  economic  conditions,  commodity 
price  volatility,  technological  innovation,  competitive 
forces  and  environmental  issues.  To  ensure 
that  royalty  regimes  meet  their  objectives,  the 
Department  monitors  how  the  regimes  are 
working  and  how  they  are  affected  by  changes 
in  the  industry.  Overall,  the  purpose  of  royalty 
review  systems  is  to  measure,  monitor  and 
assess  the  effectiveness  of  the  royalty  regimes. 

What  we  examined 

In  2007,  we  examined  the  Department’s  systems 
for  royalty  review  and  made  five  recommendations 
(our  October  2007  Report,  vol.  1 — pages  115-132). 
Our  audit  objective  was  to  determine  whether  the 
Department’s  systems  to  support  royalty  review 
were  adequate. 

Our  recommendations  were  that  the  Department 
should: 

• clearly  describe  and  publicly  state  the 
government’s  royalty  regime  objectives 

• improve  the  planning,  coverage  and  reporting 
of  its  technical  review  work 

• improve  its  annual  performance  measures  of 
the  royalty  regimes’  results 

• periodically  report  to  the  public  on  its  royalty 
regimes 


• enhance  controls  over  its  monitoring  and 
technical  review  work 

In  2010,  when  we  followed  up  on  the 
Department’s  progress  in  implementing  these  five 
recommendations,  we  considered  our  original 
recommendations  in  light  of  changes  in  the 
province’s  royalty  regimes  and  in  the  industry 
since  2007. 

Why  it  is  important  to  Albertans 

The  economic  impact  of  the  oil  and  gas  industry 
and  the  significance  of  royalty  revenue  for  funding 
services  such  as  health  care,  education  and 
infrastructure,  make  it  important  that  the  royalty 
regimes  are  well-designed  and  monitored  to  align 
with  the  government’s  policy  goals  and  objectives. 

What  we  found 

The  Department  has  improved  its  systems  for 
completing  technical  review  work  and  reporting 
the  objectives  and  performance  of  the  province’s 
royalty  regimes.  The  Department  has  implemented 
controls  and  improved  its  processes  for  planning, 
executing  and  reporting  on  its  technical  review 
work.  The  Department  has  implemented  four  of 
the  recommendations  and  has  made  satisfactory 
progress  in  implementing  our  recommendation  for 
improving  performance  measures. 


Recommendations 
The  Department  needed  to: 

Conventional 
oil  and 
natural  gas 

Oil  sands 

Clearly  describe  and  publicly 
state  the  government  s royalty 
regime  objectives 

Implemented 

Implemented 

Improve  the  planning,  coverage 
and  reporting  of  its  technical 
review  work 

Implemented 

Implemented 

Improve  its  annual  performance 
measures  of  the  royalty 
regimes'  results 

Implemented 

Satisfactory 

Progress 

Periodically  report  on  its  royalty 
regimes 

Implemented 

Implemented 

Enhance  controls  over  its 
monitoring  and  technical  review 
work 

Implemented 

Implemented 

Table  1 : Status  of  recommendations 
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The  Department  developed  performance  measures 
and  supplementary  indicators  to  monitor  the 
success  of  its  conventional  oil  and  natural  gas 
royalty  regimes  in  meeting  the  government's 
objective  of  ensuring  investment  competitiveness 
in  relation  to  other  jurisdictions.  The  Department 
plans  to  use  these  new  indicators  and  performance 
measures  for  reporting  in  2011 . 

The  Department  has  not  yet  developed  measures 
to  assess  the  performance  of  the  oil  sands  royalty 
regime.  To  develop  oil  sands  competitiveness 
indicators  and  measures,  the  Department 
must  determine  what  measures  best  reflect  the 
investment  competitiveness  of  the  oil  sands. 

At  the  time  of  our  audit,  the  Department  was 
working  on  developing  appropriate  measures  and 
supplementary  indicators  for  the  oil  sands. 

What  remains  to  be  done 

To  fully  implement  our  recommendation,  the 
Department  should  develop  and  periodically 
report  its  performance  targets,  measures  and 
supplementary  indicators  for  the  oil  sands  royalty 
regime. 


Audit  objectives  and  scope 


Our  follow-up  audit  objective  was  to  determine 
if  the  Department  has  implemented  the  five 
recommendations  from  our  October  2007  Report. 
The  scope  of  our  audit  was  to  determine  whether 
the  Department  has  effective  systems  for  reviewing 
the  government’s  royalty  regimes.  Our  mandate 
does  not  extend  to  determining  whether  royalty 
policy  objectives  are  suitable. 

We  conducted  our  field  work  from  April  2010  to 
December  2010  and  focused  on  the  Department's 
actions  since  our  2007  audit. 


Background 


The  private  sector  develops  Alberta’s  energy 
resources.  Through  the  development  of  oil  and 
gas  resources,  Albertans  receive  benefits  from 
economic  activity,  from  taxes  and  from  royalties 
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The  government's  royalty  regimes  have  to  strike 
a balance  between  maximizing  the  return  to 
Albertans  from  oil  and  gas  production  and  providing 
incentive  for  companies  to  explore  for  and  produce 
Alberta’s  resources  Royalties  alone  do  not  account 
for  all  economic  benefits  from  development  and 
exploration  of  energy  resources  Investment  in  the 
energy  sector  brings  other  benefits — for  example 
it  helps  create  jobs  and  stimulate  the  development 
of  infrastructure  Thus,  if  royalty  rates  are  too 
high,  investment  will  be  impaired  and,  in  the  long 
term,  the  total  economic  benefit  may  decline  On 
the  other  hand,  if  royalty  rates  are  too  low.  an 
appropriate  return  from  oil  and  gas  resources  for 
Albertans  may  not  be  realized  In  short,  an  effective 
royalty  regime  strikes  the  right  balance  between 
royalties  and  investment,  to  maximize  long-term 
economic  benefits  for  Albertans.  The  Department 
monitors  the  performance  of  the  province’s 
royalty  regimes,  to  make  sure  they  support  this 
overall  objective.  The  Department  is  responsible 
for  communicating  the  objectives,  targets  and 
outcomes  of  the  royalty  regimes. 

Since  2007,  the  Department  s royalty  regimes  have 
undergone  significant  changes,  most  notably 

• In  2007,  the  government  announced  the 
New  Royalty  Framework'  that  came  into 
effect  in  2009 

• In  2008,  the  government  announced 
transitional  royalty  rates1 2  for  conventional  oil 
and  natural  gas  in  response  to  rapid  declines  in 
commodity  prices  and  drilling  activity 

• In  2009,  the  government  announced  programs3 
such  as  a drilling  royalty  credit  and  new  well 
royalty  rate,  to  encourage  investment  during  an 
economic  downturn  and  decline  in  commodity 
prices. 

• In  2010,  the  Department  conducted  a study4 
of  Alberta’s  conventional  oil  and  natural  gas 
investment  competitiveness  Based  on  the 

1 New  Royalty  Framework.  October  25,  2007 

2 Alberta  to  offer  transitional  royalty  rates  to  promote 
new  dnlling.  Government  of  Alberta  News  Release. 
November  19,  2008 

3 Province  announces  three-point  incentive  program  for 
energy  sector,  Government  of  Alberta  News  Release. 
March  3,  2009 

4 Energizing  Investment.  March  11.  2010 
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study,  the  government  reduced  royalty  rates 
for  conventional  oil  and  natural  gas  and  added 
royalty  programs  for  shale,  horizontal  and  coal 
bed  methane  production. 

The  industry  has  also  undergone  significant 
changes  since  2007.  For  example,  across 
North  America  the  industry  has  rapidly  expanded 
its  use  of  horizontal  drilling  and  hydraulic  fracturing5 
technology,  which  allows  producers  to  access 
shale  gas  deposits  economically.  Application  of 
this  technology  has  increased  the  supply  of  natural 
gas,  and  has  put  downward  pressure  on  prices. 
Better  use  of  technology  has  also  increased 
access  to  larger  amounts  of  oil.  As  a result  of 
these  developments,  opportunities  to  exploit 
conventional  oil  and  natural  gas  are  becoming 
less  scarce  in  neighbouring  jurisdictions  and  are 
attracting  an  increasing  amount  of  investment. 

The  government  has  concluded  that  an  exclusive 
focus  on  maximizing  royalties  is  not  the  best 
response  to  technological  and  economic  changes, 
and  now  places  stronger  emphasis  on  investment 
competitiveness.  In  the  context  of  royalties,  a 
competitive  regime  provides  risks  and  rewards  that 
are  suitable  for  a targeted  level  of  investment. 


Findings 


Royalty  regime  objectives  and 
targets — implemented 

Background 

In  our  October  2007  Report  (no.  9 — page  115), 
we  recommended  that  the  Department  of  Energy 
clearly  describe  and  publicly  state  the  objectives 
and  targets  of  Alberta’s  royalty  regimes. 

Governments  need  assurance  that  their  royalty 
regimes  are  meeting  strategic  priorities  and 
objectives.  Royalty  regimes  may  be  altered  as 
government  objectives  change  to  address  new 
opportunities  and  challenges.  The  government, 
in  the  context  of  royalties,  has  to  make  decisions 

5 A process  where  internal  fluid  pressure  fractures  the 

formation,  enabling  petroleum  to  flow  more  freely  out  of  the 
well. 


based  on  two  competing  alternatives:  maximizing 
return  from  resource  development  and  encouraging 
the  development  of  the  resource.  For  many 
years,  Alberta  has  expressed  royalty  objectives 
around  securing  benefits  for  Albertans  and  being 
competitive.  Both  are  considered;  however,  the 
emphasis  can  shift  depending  on  economic 
circumstances. 

In  2007,  the  government’s  focus  was  to  ensure  that 
the  returns  from  royalties  for  extraction  of  oil  and 
gas  in  Alberta  were  as  high  as  possible  without 
impeding  investment.  The  primary  measure  of  this 
objective  was  determining  what  share  of  profits 
the  government  was  receiving  from  extraction 
of  the  resource.  However,  at  that  time  we  found 
inconsistent  and  ill-defined  targets  for  this  objective. 

In  2010,  we  examined  whether  the  Department  had 
clearly  communicated  the  objectives  and  targets  of 
the  royalty  regimes  in  its  most  recent  publications, 
including  publicly  available  documents  as  well  as 
internal  information. 


Criteria:  the  standards  for  our  audit 

The  Department  should  clearly  define  and 
communicate  objectives  for  its  royalty  regimes. 


Our  audit  findings 


Key  Points 


• Objectives  of  royalty  regimes  are  clearly  stated 

• Targets  for  conventional  oil  and  natural  gas  have 
been  developed 

• Targets  for  oil  sands  royalty  regime  to  be  specified 
once  oil  sands  royalty  performance  measures  have 
been  developed 

The  Department  implemented  this  recommendation 
by  clearly  communicating  the  primary  objective 
of  the  conventional  oil,  natural  gas  and  oil  sands 
royalty  regimes. 

The  Ministry  of  Energy’s  2010-2013  business 
plan  states  as  the  first  goal,  that:  “Alberta  has 
a competitive  and  effective  royalty  system, 
incenting  development  and  maximizing  benefits  to 
Albertans.”  The  concept  of  maximizing  benefits  to 
Albertans  remains  consistent;  however,  there  is  a 
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greater  emphasis  on  having  a competitive  royalty 
system  and  encouraging  investment.  A key  factor 
behind  this  shift  in  emphasis  relates  to  the  review6 
completed  in  2010  to  assess  Alberta's  competitive 
position  in  the  conventional  oil  and  natural  gas 
industry.  The  review  noted  a number  of  challenges 
facing  the  conventional  oil  and  gas  sector,  including 
aggressive  competition  from  other  jurisdictions, 
maturity  of  the  resource,  economic  and  commodity 
volatility  and  higher  costs  of  development.  Based 
on  this  review,  the  government  concluded  that 
changes  to  the  conventional  oil  and  natural 
gas  royalty  regimes  were  needed,  and  that  a 
focus  on  encouraging  investment  was  required. 

The  objective  of  encouraging  investment  is 
expressed  consistently  in  both  external  and 
internal  Department  publications.  For  example,  an 
announcement7  from  the  Premier  and  the  Minister 
of  Energy  articulated  the  objective  to  increase 
production,  employment  and  other  benefits  through 
the  modification  of  the  conventional  oil  and  natural 
gas  royalty  regimes. 

A shift  in  emphasis  toward  encouraging  investment 
is  apparent  through  the  type  of  targets  and 
measures  used.  For  example,  in  the  2010-2013 
business  plan,  the  targets  and  measures  are  based 
on  conventional  oil  and  natural  gas  royalty  and  tax 
rates  in  comparison  to  other  jurisdictions,  and  the 
supplementary  indicators  focus  on  level  of  industry 
activity.  Previously,  the  targets  and  measures  were 
focused  on  percentage  of  profits  received  from 
the  extraction  of  the  resource.  The  Department 
continues  to  analyze  the  return  from  the  resource 
by  examining  the  profits  industry  receives  from 
production  and  what  share  the  government 
receives  through  royalties;  however,  the 
Department  has  stated  that  this  is  one  component 
of  many  to  be  considered  in  the  analysis  of  the 
royalty  regimes.  Thus,  the  Department  concluded 
that  this  is  not  an  objective  in  itself,  but  rather  a 
tool  to  help  calibrate  where  to  position  Alberta  in 
relation  to  similar  jurisdictions.  The  2010-2013 
business  plan  states  that:  “Success  is  measured 


6 Energizing  Investment,  March  11,  2010 

7 Alberta  delivers  on  oil  and  gas  competitiveness. 
Government  of  Alberta  News  Release,  March  11,  2010 


by  sustaining  vibrant  industry  activity,  and  a 
competitive  fiscal  regime  that  attracts  investment 

Within  the  competiveness  study,  the  government 
stated  that  oil  sands  were  not  included,  given  their 
unique  position  in  this  area  and  the  continued 
success  in  attracting  significant  investment  in  new 
and  expanding  oil  sands  projects  The  2010-2013 
business  plan  includes  the  oil  sands  royalty 
regime  as  part  of  the  overall  goal  and  objective  of 
having  competitive  and  effective  royalty  regimes 
The  Department  concludes  that  although  the 
opportunities  and  the  challenges  are  different  in  the 
oil  sands,  the  overall  objective  is  relevant  as  the  oil 
sands  royalty  regime  should  remain  responsive  to 
changing  conditions  and  maintain  investor  certainty 
However,  the  Department  has  not  yet  developed 
targets  and  measures  to  assess  whether  this 
objective  is  being  met  This  is  discussed  on 
page  35. 

Planning,  coverage  and  internal 
reporting — implemented 

Background 

In  our  October  2007  Report  (no  10 — page  119), 
we  recommended  that  the  Department  improve 
the  planning,  coverage  and  internal  reporting  of  its 
royalty  review  work. 

In  2010,  we  examined  the  changes  that  the 
Department  has  made  to  its  systems  for  planning, 
executing  and  reporting  its  royalty  review  work 
As  part  of  our  audit,  we  examined  systems  the 
Department  uses  to  determine  the  coverage  of  its 
technical  review  work,  how  it  sets  technical  review 
priorities  and  deliverables,  and  how  it  deploys 
resources  to  meet  those  priorities. 


Our  audit  findings 


Key  Points 


• Detailed  and  complete  project  plans  are  being 
developed  for  technical  review  work 

• Reporting  of  technical  review  work  is  occurring  as 
stated  in  the  plans 
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The  Department  has  implemented  this 
recommendation  with  respect  to  its  work  in  the 
conventional  oil  and  natural  gas  area  and  in  the  oil 
sands  area. 

The  Department  has  changed  its  organizational 
structure  in  the  technical  review  area  to  bring 
its  personnel  and  resources  for  conventional 
oil,  natural  gas  and  the  oil  sands  into  a single 
organizational  unit  and  under  a single  line  of 
management.  This  allows  the  Department  to  further 
improve  planning  of  its  work  and  better  coordinate 
deployment  of  its  resources. 

The  Department  has  developed  formal  systems  to 
plan  its  technical  review  work.  For  each  technical 
analysis  project,  the  Department  prepares  a 
detailed  plan  that: 

• outlines  project  objectives,  details  the  work  to 
be  done,  and  identifies  internal  and  external 
stakeholders  involved 

• sets  a project  schedule  with  interim  and  final 
deliverables 

• allocates  resources  and  defines  reporting 
relationships 

Once  a project  begins,  the  Department  formally 
monitors  progress  against  the  schedule  outlined  in 
the  plan.  Final  project  reports  focus  on  objectives 
set  out  in  the  plans  and  provide  detailed  analysis  of 
the  findings.  Final  reports  are  delivered  to  the  level 
of  management  outlined  in  the  plans. 

We  were  able  to  observe  implementation  of  these 
new  and  improved  systems  on  the  Department's 
conventional  oil  and  natural  gas  projects,  including 
the  competitiveness  review  study.  No  similar 
technical  work  has  been  done  in  the  oil  sands 
area  because  the  Department  is  still  working  on 
determining  oil  sands  performance  measures  and 
indicators  (see  below).  The  Department  plans  to 
use  the  same  planning,  coverage  and  internal 
reporting  systems  for  technical  work  in  both  areas. 
In  the  future,  we  will  confirm  this  as  part  of  our 
annual  financial  audit  work. 


Improving  annual  performance 
measures 

Conventional  oil  and  natural  gas  performance 

measures — implemented 

Oil  sands  performance  measures — satisfactory 

progress 

Background 

In  our  October  2007  Report  ( no.  11 — page  124), 
we  recommended  that  the  Department  improve 
its  annual  performance  measures  for  the  royalty 
regime. 

In  2010,  we  examined  whether  the  new 
performance  measures  reported  by  the  Department 
were  consistent  with  the  stated  objectives  of  the 
royalty  regimes.  We  also  considered  whether  the 
performance  measures  would  accurately  portray 
whether  or  not  the  royalty  regimes  are  successful  in 
meeting  their  objectives. 

The  conventional  oil,  natural  gas  and  oil  sands 
royalty  regimes  are  designed  and  administered 
differently.  In  particular,  the  costs,  risks, 
opportunities  and  challenges  of  the  oil  sands 
royalty  regime  require  that  it  be  considered 
independently  of  conventional  oil  and  natural 
gas,  although  the  objectives  of  these  regimes 
are  similar.  We  expect  the  design  of  particular 
performance  measures  to  reflect  both  the 
similarities  and  the  differences  between  the  royalty 
regimes,  and  to  allow  for  a fair  assessment  of 
performance  against  objectives  and  targets. 


Criteria:  the  standards  for  our  audit 

The  Department  should  periodically  and  publicly 
report  information  about  the  performance  of  its 
royalty  regimes  against  program  objectives. 


Our  audit  findings 


Key  Points 


• A new  performance  measure  for  conventional  oil 
and  natural  gas  royalties  has  been  developed 

• Performance  measures  for  the  oil  sands  royalty 
regime  have  not  been  developed 
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Conventional  oil  and  natural  gas 
The  Department  has  implemented  the 
recommendation  In  the  Ministry's  2010-2013 
business  plan,  the  Department  has  developed  the 
new  measure  and  supplementary  indicators  for 
conventional  oil  and  natural  gas  to  be  included 
in  the  Ministry’s  future  annual  reports  The 
measure  uses  a combined  tax  and  royalty  rate 
for  conventional  oil  and  natural  gas  production  in 
Alberta  in  comparison  to  other  jurisdictions  The 
stated  target  for  this  measure  is  that  Alberta  will 
have  a combined  royalty  and  tax  rate  that  is  in  the 
top  quartile  of  investment  opportunities  compared 
to  similar  jurisdictions  The  measure  will  help  the 
Department  to: 

• monitor  the  effectiveness  and  competitiveness 
of  Alberta's  royalty  regime  in  light  of  changing 
economic  circumstances 

• ensure  Alberta’s  royalty  regime  continues  to 
support  the  Government  of  Alberta’s  economic 
and  resource  development  objectives 

The  Department  indicated  it  will  report  on  the  new 
measure  annually.  The  measure  will  represent  the 
combined  royalty  and  tax  rates  for  conventional 
oil  and  separately  for  natural  gas,  and  will 
demonstrate  how  the  combined  rates  compare  to 
those  in  other  jurisdictions  This  separate  reporting 
on  conventional  oil  and  natural  gas  is  important, 
as  the  opportunities  and  challenges  for  each 
commodity  can  differ.  The  Department  will  also 
report  supplemental  indicators,  such  as  production 
and  metres  drilled  to  provide  further  information  on 
industry  activity. 

The  Department  continues  to  include  an  upstream 
oil  and  gas  industry  investment  (including  oil 
sands)  performance  measure  in  its  annual  report 
In  2007,  we  found  that  the  target  for  this  measure 
(approximately  $15  billion  at  that  time)  had  been 
static  for  a number  of  years,  and  had  not  been 
indexed  to  inflation  while  the  oil  and  gas  industry 
was  experiencing  rapidly  rising  costs  Since  that 
time,  the  Department  has  annually  adjusted  its 
target  to  incorporate  general  and  industry-specific 
inflation  and  any  other  factors  that  influence  the 
Department’s  investment  target  The  target  range 
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for  2010-2011  is  $23  to  $30  billion  This  measure  is 
intended  to  provide  an  overall  picture  of  the  amount 
of  investment  in  Alberta  s oil  and  gas  upstream 
industry 

Starting  with  the  2009-2010  Ministry  annual 
report,  the  Department  is  no  longer  including  the 
"sharing  the  revenue  from  resource  development  ‘ 
measure  The  Department  removed  the  measure 
because  management  determined  that  this 
measure  reflected  only  a short-term  view  of  a 
royalty  regime’s  effectiveness  and  did  not  reflect 
the  perspective  of  a long-term  impact  on  industry 
investment  and  related  economic  benefits  for 
Albertans 

Oil  sands 

The  Department  has  made  satisfactory  progress 
in  implementing  this  recommendation  for  the 
oil  sands  performance  measures  and  targets 
The  Department  has  worked  on.  but  not  yet 
fully  designed  performance  measures  and 
supplementary  indicators  for  the  oil  sands  area 
The  Department’s  current  challenge  is  to  identify  a 
useful  measure  that  provides  clear  information  on 
whether  the  oil  sands  royalty  regime  is  meeting  the 
province's  objectives 

The  size  and  nature  of  the  oil  sands  resource  is 
unique  to  Alberta,  oil  and  gas  operations  in  other 
jurisdictions  are  not  directly  comparable  to  it  For 
example,  the  competitive  risk  of  a similar  natural 
gas  shale  resource  in  a neighbouring  jurisdiction  is 
apparent,  whereas  the  oil  sands  resource  does  not 
face  a similar  competitive  challenge  As  a result, 
the  Department  must  perform  analyses  to  identify 
specific  measures  and  indicators  for  investment 
competitiveness  of  the  Alberta  oil  sands  royalty 
regime  This  work  is  still  under  way  Specific  oil 
sands  royalty  regime  measures  and  indicators  are 
not  yet  in  place 

To  fully  implement  this  recommendation,  the 
Department  should  develop  performance  measures 

8 Calculated  by  determining  the  portion  of  oil  and  gas 

industry's  annual  net  operating  revenue  that  is  paid  to  the 
Crown  as  royalty,  using  a three-year  moving  average 


Report  of  the  Auditor  General  of  Alberta 


April  2011 


Royalty  Review  Systems — Follow-up  Audit 


for  the  oil  sands  royalty  regime  that  relate  to  the 
government’s  objectives  and  targets. 


Implications  and  risks  if  recommendation 
not  implemented 

Until  clearly  stated  oil  sands  royalty  regime  targets 
and  measures  are  in  place,  the  Department  will  not 
be  able  to  readily  demonstrate  the  effectiveness  of 
its  oil  sands  royalty  regime. 

Periodic  public  information — 
implemented 

Background 

In  our  October  2007  Report  (no.  12 — page  126), 
we  recommended  that  the  Department 
periodically  report  to  resource  owners,  MLAs 
and  stakeholders  about  the  performance  of 
and  issues  for  Alberta’s  royalty  regimes  and  to 
demonstrate  the  Department’s  capacity  and 
methodology  to  analyze  its  royalty  regimes. 

In  2010,  we  examined  what  information  the 
Department  has  developed  and  made  available 
to  satisfy  those  who  need  information  about  the 
province’s  royalty  regimes. 


Criteria:  the  standards  for  our  audit 

The  Department  should  periodically  and  publicly 
report  on  the  performance  of  its  royalty  regimes 
against  program  objectives. 


Our  audit  findings 


Key  Points 


• Comprehensive  information  about  royalties  and 
the  oil  and  gas  industry  is  being  made  available  to 
the  public 

• The  key  results  and  conclusions  of  recent  reviews 
and  studies  on  royalties  have  been  made  publicly 
available 

The  Department  has  implemented  this 
recommendation  with  respect  to  its  work  in  the 
conventional  oil  and  natural  gas  area  and  in  the 
oil  sands  area.  The  Ministry’s  annual  report  is  the 
primary  mechanism  for  reporting  on  the  royalty 
regimes.  The  Ministry  of  Energy  2009-2010  Annual 
Report  includes  discussion  on  the  challenges 


facing  royalty  revenues,  the  anticipated  outcomes 
of  the  royalty  regimes  and  what  changes  have 
occurred  to  the  royalty  regimes  over  the  past  year. 
Since  2007,  the  Department  has  also  added  a 
variety  of  statistics  related  to  the  royalty  regimes, 
such  as  production  numbers,  average  commodity 
prices,  wells  drilled  and  well  licences  issued.  The 
Department  also  releases  monthly  updates  on  well 
licences,  wells  spudded  (drilling  has  started),  well 
completions,  drilling  rig  activity  and  land  sales. 

In  2009,  the  Department  released  a public 
document9  that  provides  an  overview  of  what 
royalties  are,  the  history  of  royalties  in  Alberta, 
how  royalties  are  collected  and  how  royalties  are 
calculated.  The  document’s  purpose  is  to  provide 
an  understandable  and  general  overview  of  oil  and 
gas  royalties.  The  Department  also  completed  a 
jurisdictional  comparison10  to  develop  a framework 
for  comparing  other  governments’  royalty  and  tax 
rates  on  oil  and  gas  production.  This  document  is 
also  publicly  available. 

In  2010,  the  government  announced  a significant 
change  to  conventional  oil  and  natural  gas 
royalties,  as  a result  of  a competitiveness  study 
completed  by  the  Department.  The  results  of  the 
study* 11  are  available  to  the  public,  as  well  as  much 
of  the  supporting  technical  information  used  in 
formulating  its  conclusions.  The  oil  sands  royalty 
regime  was  last  modified  in  2009,  as  a result  of 
the  province’s  new  royalty  framework.12  The  recent 
competitiveness  review  of  conventional  oil  and 
natural  gas  royalties  and  royalty  programs13  did  not 
include  oil  sands  royalties. 

To  help  identify  information  to  provide  publicly,  the 
Department  engaged  a consultant  to  assess  its 
communication  strategy.  The  primary  purpose  was 
to  identify  what  information  Albertans  wanted  to 
know  about  the  royalty  regimes  and  how  best  to 
communicate  it.  The  Department  drew  a number 

9 Energy  Economics:  Understanding  Royalties, 

September  2C09 

1 0 Alberta's  Royalty  System — Jurisdictional  Comparison, 
September  2009 

11  Energizing  Investment,  March  11, 2010 

12  New  Royalty  Framework,  October  25,  2007 

13  Energizing  Investment,  March  11,  2010 
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of  conclusions  from  this  work,  specifically,  that 
communication  should  be  focused  on  the  royalty 
regimes'  economic  outcomes,  such  as  the  impact 
on  investment  and  employment 

We  were  able  to  observe  a greater  level  of  public 
reporting  by  the  Department  in  the  conventional 
oil  and  natural  gas  areas  Due  to  its  continuing 
work  on  the  oil  sands  performance  measures  and 
indicators,  the  Department  has  not  yet  started 
public  reporting  at  a similar  level  with  respect  to  the 
oil  sands  royalty  regime  However,  the  same  public 
reporting  systems  will  be  used  in  both  areas,  and 
the  Department  has  confirmed  to  us  its  commitment 
to  report  a comparable  level  of  information  for 
the  oil  sands  regime  For  these  reasons,  we 
conclude  that  the  Department  has  implemented 
this  recommendation  for  both  the  conventional  oil 
and  natural  gas  area  and  the  oil  sands  area  In  the 
future,  once  the  oil  sands  performance  measures 
are  ready  and  technical  work  is  done,  we  will 
review  the  Department’s  oil  sands  public  reporting 
as  part  of  our  annual  financial  audit  work. 

Enhancing  controls — implemented 

Background 

In  our  October  2007  Report  (no.  13 — page  129), 
we  recommended  that  the  Department  enhance 
controls  for  its  monitoring  and  technical 
review  work. 

In  2010,  we  examined  how  the  Department 
changed  its  systems  for  controlling  the  quality  of 
its  technical  review  work.  As  part  of  our  follow-up, 
we  examined  how  the  Department  documents 
the  work  done,  sources  of  data  and  economic 
assumptions  used  We  also  focused  on  design 
and  implementation  of  systems  to  control  quality 
of  the  technical  work,  including  periodic  reviews  by 
management. 

We  did  not  re-examine  the  specific  calculations 
and  detailed  analytical  procedures  performed 
by  Department  staff,  as  we  had  not  identified 
issues  with  this  work  during  the  original  audit 
Consequently,  we  focused  our  follow-up  audit  on 
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assessing  the  design  and  implementation  of  the 
Departments  control  system 


Our  audit  findings 


Key  Points 


• Controls  over  technical  review  work  have  improved 

• Systems  to  manage  internal  and  external 
information  and  action  requests  have  improved 

The  Department  has  implemented  this 
recommendation  for  conventional  oil  and  natural 
gas.  as  well  as  for  oil  sands  The  Department  has 
introduced  formal  systems  to  document  and  track 
sources  of  data  economic  assumptions  and  work 
done  by  individual  analysts  The  Department  has 
also  formalized  detailed  analytical  methodologies 
for  conventional  oil  and  natural  gas  This  helps 
the  Department  manage  its  internal  knowledge 
and  ensures  that,  with  staff  turnover,  a qualified 
replacement  can  take  over  with  minimal  process 
disruption  and  knowledge  loss 

The  Department  has  improved  its  systems  to 
review  the  quality  of  its  technical  work  These 
quality  reviews  take  place  at  two  levels  At  the 
peer  review  level,  key  analysis  and  results  are 
reviewed  by  another  analyst  On  the  management 
level,  quality  reviews  are  done  at  specific  times, 
as  required  by  a project  plan  These  reviews  help 
minimize  the  number  of  technical  errors  and  ensure 
consistent  use  of  assumptions  and  analytical  tools 
Outcomes  of  quality  reviews  are  clearly  stated  and 
documented  internally 

The  Department  has  improved  its  system  to  track 
and  reference  sources  of  key  results  and  figures 
in  its  reports  While  final  reports  may  not  provide 
complete  referencing,  the  Department  maintains 
internal  versions  of  documents  with  detailed 
referencing,  which  would  enable  it  to  provide  a link 
to  specific  data  sources  in  case  there  is  a need 
for  it. 

The  Department  has  improved  and  formalized 
its  systems  to  manage  internal  and  external 
information  and  action  requests  The  Department 
has  formalized  the  process  to  receive,  process 
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and  act  on  requests  for  technical  review  work 
and  related  information.  When  the  Department 
begins  to  take  action  on  such  requests,  it  initiates 
the  project  planning  process  mentioned  earlier  in 
this  report.  By  following  these  project  plans,  the 
Department  ensures  that  its  responses  to  questions 
and  action  requests  are  complete  and  timely. 

We  were  able  to  observe  implementation  of  these 
new  and  improved  systems  on  the  Department’s 
conventional  oil  and  natural  gas  projects,  including 
the  competitiveness  review  study.  No  similar 
technical  work  has  been  done  in  the  oil  sands 
because  the  Department  is  still  working  on 
determining  oil  sands  performance  measures 
and  supplementary  indicators.  The  Department 
informed  us  the  same  control  systems  will  be  used 
for  technical  work  in  both  areas.  In  the  future, 
once  the  oil  sands  performance  measures  and 
supplementary  indicators  are  ready  and  technical 
work  is  done,  we  will  review  the  Department’s 
use  of  quality  controls  in  the  oil  sands  technical 
work  as  part  of  our  annual  financial  audit  work. 
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Enterprise  risk  management — 
implemented 

Background 

In  our  October  2002  Report  (no.  16 — page  101), 
we  recommended  that  Alberta  Treasury  Branches1 
(ATB)  develop  an  integrated  approach  to  effectively 
manage  operational,  credit  and  market  risk.  We 
repeated  this  recommendation  in  our  October  2003 
Report  (no.  16 — page  121). 

Enterprise  risk  management  (ERM)  is  an  approach 
used  by  organizations  to  manage  risks  related  to 
the  achievement  of  their  objectives.  ERM  helps 
ATB  management  account  for  its  risk  management 
responsibilities,  and  engage  ATB’s  board  of 
directors  in  discussions  about: 

• the  nature,  likelihood  and  potential  impact  of 
risks  related  to  ATB 

• ATB’s  tolerance  for  various  risks 

• the  status  of  controls  to  mitigate  risks 

• the  cost  and  priority  of  initiatives  to  mitigate 
risks 

• the  results  of  ongoing  monitoring 

In  2008,  ATB  created  the  position  of  Chief  Risk 
Officer  (CRO).  ATB’s  accountability  profile  states 
that  the  CRO  “owns,  manages  and  develops  the 
risk  management  function  in  line  with  industry  best 
practice.  The  CRO  sets  ATB’s  risk  management 
policies  and  business  rules,  monitors  compliance 
with  them  and  provides  risk  information  to  ATB’s 
management  and  board  of  directors.”2 

This  year,  we  reviewed  ATB's  progress  in 
implementing  our  recommendation.  We  reviewed 
key  ATB  documents,  as  well  as  the  responsibilities 
and  accountabilities  of  corporate  committees 
formed  to  implement  its  risk  management  strategy. 

Our  audit  findings 

ATB  implemented  this  recommendation  by 
developing  an  ERM  framework.  In  August  2009, 
ATB  formalized  its  approach  to  risk  management 
by  approving  its  ERM  framework  and  policy. 

1 Now  ATB  Financial 

2 Accountability  Profile,  ATB  Financial,  page  1 


ATB’s  ERM  framework:3 

• identifies  and  defines  key  risks  as  being 
strategic,  business,  reputation,  regulatory, 
credit,  market,  liquidity  and  operational 

• outlines  principles  for  assigning  risk  ownership 

• details  the  risk  governance  structure 

• defines  risk  appetite  and  limits 

• describes  impact  and  likelihood  ratings 

• describes  options  for  the  treatment  of  risks  and 
risk  treatment  planning 

• defines  and  sets  out  expectations  for  stress 
testing  the  ERM  strategy 

ATB’s  ERM  policy4  includes  a: 

• process  for  identifying  how  much  risk  ATB  is 
prepared  to  accept 

• process  for  reporting  its  risks 

• requirement  for  stress  testing  the  ERM  strategy 

• delegated  authority  and  accountability  structure 

ATB  has  also: 

• completed  a risk  appetite  statement  that 
defines  the  level  of  risk  ATB  is  willing  to 
accept — ATB  assigned  individual  risk  appetite 
ratings  for  each  key  risk. 

• presented  a Risk  Committee  Report  in 
November  2010  to  its  board  of  directors — This 
report  presented  the  results  of  a corporate-wide 
risk  survey  facilitated  by  management.  It 
identified  ATB’s  most  significant  risks  coming 
out  of  the  risk  survey,  along  with  the  potential 
impacts  and  likelihood  of  these  risks  to  ATB. 

While  there  is  still  some  work  to  be  done,  ATB 
has  completed  sufficient  work  to  implement 
components  of  an  ERM  process,  thereby 
successfully  implementing  our  recommendation. 
Although  ATB  has  not  yet  performed  stress  testing 
on  key  corporate  risks,  identified  leading  indicators 
or  formulated  mitigation  strategies,  we  understand 
that  these  initiatives  are  planned  as  ATB  continues 
to  develop  its  enterprise  risk  management 
processes.  We  encourage  ATB  to  continue  its  ERM 
process  development. 

3 Enterprise  Risk  Management  Framework,  ATB  Financial, 
August  27,  2009 

4 Enterprise  Risk  Management  Policy,  ATB  Financial, 

August  2009 


Report  of  the  Auditor  General  of  Alberta 


April  2011 


t Ministry  of  Finance  and  Enterprise — Alberta  Treasury  Branches 

Enterprise  Risk  Management— Follow-up  Audit 


Report  of  the  Auditor  General  of  Alberta 


April  2011 


Treasury  Management — Follow-up  Audit 


Summary 


Treasury  management  means  planning,  organizing 
and  controlling  the  funds  of  an  organization, 
optimally,  profitably  and  within  acceptable  levels 
of  risk.  ATB  Financial  (ATB)  is  exposed  to  treasury 
risks  that,  if  not  adequately  managed,  could 
prevent  ATB  from  meeting  its  business  objectives. 
Treasury  risks  include  risks  related  to  investments, 
liquidity,  interest  rates,  foreign  exchange,  and  credit 
risk  related  to  securities  and  derivatives. 

In  2008,  we  assessed  whether  ATB  had  effective 
systems  to  manage  its  treasury  risks.  In  this 
follow-up  audit,  we  assessed  ATB’s  progress 
implementing  12  of  the  15  recommendations 
we  made  in  our  October  2008  Report  (pages 
109-149).  Three  recommendations  from  2008 
remain  outstanding;  we  did  not  assess  their 
implementation  as  part  of  this  follow-up  audit. 

What  we  examined 

We  assessed  ATB’s  progress  improving  the  way  it 
manages  its  treasury  risks.  Specifically,  we  followed 
up  on  ATB’s  progress  with  improving  its: 

• processes  for  making  investments, 
establishing  performance  targets  and  awarding 
performance  pay  for  investment  activities 

• processes  for  complying  with  the  Minister 
of  Finance  and  Enterprise’s  guideline  for 
liquidity,  liquidity  reporting,  liquidity  contingency 
planning  and  liquidity  risk  identification 
processes 

• processes  for  creating,  applying  and  validating 
assumptions  used  in  its  models  for  interest 
rate  risk  exposure;  for  reporting  to  senior 
management  and  ATB's  board  of  directors 

on  these  exposures;  defining  and  modeling 
significant  interest  rate  risk  exposures 

• treasury  management  policies 

• internal  audit  processes  to  regularly  examine 
ATB’s  derivative  activities 

• Asset  Liability  Committee's  (ALCO's) 
effectiveness 


Why  it  is  important  to  Albertans 

ATB  provides  financial  services  to  over  685,000 
customers  in  approximately  240  Alberta 
communities  and  has  over  $26  billion  in  assets. 
ATB’s  profits  belong  to  all  Albertans,  along  with 
a risk  of  loss  because  the  Government  of  Alberta 
provides  a deposit  guarantee  to  all  ATB  depositors. 
Because  of  the  deposit  guarantee,  Albertans  have 
a significant  stake  in  ATB’s  financial  success  and  in 
how  well  ATB  manages  its  financial  risks. 

What  we  found 

We  reviewed  12  recommendations  from  2008,  and 
concluded  that  ATB  has: 

• implemented  six 

• resolved  two,  through  changed  circumstances 

• made  satisfactory  progress  with  three 

• not  made  satisfactory  progress  with 
one  recommendation;  we  repeat  this 
recommendation  in  this  report 

Since  our  original  report  in  2008,  ATB  has 
significantly  improved  its  treasury  risk  management 
systems.  Our  October  2008  Report  highlighted 
events  at  ATB  leading  up  to  the  market  disruption 
of  asset-backed  commercial  paper  (ABCP)  in 
August  2007.  Since  our  2008  audit,  ATB  has 
changed  its  investment  processes  to  respond  to  the 
lessons  learned  from  the  ABCP  market  disruption. 
While  ATB  has  improved  the  way  it  manages 
interest  rate  risk,  further  improvements  are  still 
needed. 

Some  of  the  significant  changes  ATB  has  made  to 
manage  its  treasury  risks  include: 

• improving  the  oversight  of  treasury  risks  with  a 
stronger,  strategically  focused  ALCO 

• hiring  a Treasurer  with  broad  financial 
institution  experience 

• reorganizing  its  treasury  area  to  align  roles  and 
responsibilities  to  treasury  risks 
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The  highlights  of  this  audit  are: 

• Investments — ATB  has  reduced  its  exposure 
to  individual  investment  counterparties, 

no  longer  relies  only  on  an  opinion  from 
one  credit  rating  agency  and  monitors  the 
credit  risk  of  counterparties  through  an  early 
warning  system.  Performance  incentives  that 
contributed  to  ATB  purchasing  higher  yielding 
ABCP  have  been  removed 

• Liquidity — ATB  has  standardized  the  way  it 
calculates  liquidity  and  improved  its  liquidity 
contingency  plan.  ATB  made  satisfactory 
progress  implementing  our  recommendation  on 
performing  liquidity  simulations 

• Interest  rate  risk  management — ATB 
has  improved  the  quality  and  quantity  of 
interest  rate  risk  information  being  reported 
to  ALCO  and  its  board  of  directors  ATB 
made  satisfactory  progress  with  its  interest 
rate  risk  models  and  scenarios.  We  repeat 
our  recommendation  on  interest  rate  model 
assumptions  because  ATB  has  not  done 
sufficient  work  to  implement  it. 

• Other  items — ATB'sALCO  has  replaced  its 
tactical  approach  with  a more  strategic  one, 
which  has  significantly  improved  its  overall 
effectiveness.  ATB’s  internal  auditors  regularly 
review  ATB’s  derivative  activities.  ATB  is 
making  satisfactory  progress  on  improving  its 
treasury  policies. 

What  needs  to  be  done 

ATB  still  needs  to: 

• perform  liquidity  simulations  regularly 

• improve  its  processes  for  creating,  applying 
and  validating  assumptions  used  in  its  interest 
rate  risk  models,  and  further  define  significant 
interest  rate  exposures  and  model  those 
exposures 

• update  and  review  treasury  policies  regularly 

ATB  also  still  needs  to  implement  the  remaining 

three  recommendations  that  were  not  assessed 

in  this  audit.  These  outstanding  recommendations 

deal  with: 

• upgrading  its  treasury  management  information 
systems 
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• strengthening  its  controls  over  measuring 
interest  rate  exposures 

• reviewing  the  role  of  its  middle  office'  to  ensure 
it  has  the  resources  necessary  to  fulfill  its  roles 
and  responsibilities 

ATB  told  us  that  it  expects  to  have  implemented 
the  recommendations  on  controls  over  measuring 
interest  rate  exposures  and  the  role  of  middle  office 
within  the  next  12  months 


Audit  objectives,  scope  and 
approach 


Our  objective  was  to  assess  ATB  s progress 
with  implementing  12  of  15  recommendations 
we  made  in  October  2008  ATB  indicated  to  us 
prior  to  our  audit  that  it  had  implemented  these 
12  recommendations  We  will  follow-up  on  the 
remaining  three  recommendations  when  ATB 
indicates  to  us  that  they  have  been  implemented 

We  conducted  our  audit  from  September  to 
November  2010.  Our  procedures  included 
reviewing  ATB  documentation,  discussions  with 
staff,  and  walkthroughs  and  tests  of  treasury 
processes  We  were  assisted  on  this  audit  by 
external  advisors  with  knowledge  of  treasury  and 
financial  service  industry  best  practices 


Background 


ATB  background  and  regulatory 
environment 

ATB  is  a provincially  owned  full-service  financial 
institution,  with  assets  of  over  $26  billion  at 
September  30,  2010  As  a Crown  corporation, 

ATB  operates  pursuant  to  the  Alberta  Treasury 
Branches  Act  Jand  Alberta  Treasury  Branches 
Regulation1 2 3  and  under  the  oversight  of  a board  of 
directors  appointed  by  the  Lieutenant  Governor  in 
Council.  The  ATB  board  of  directors  is  accountable 
to  the  Minister  of  Finance  and  Enterprise 


1 The  middle  office  monitors  market  risk,  values  securities 
and  denvatives,  and  ensures  compliance  with  certain 
treasury  limits/processes 

2 RSA  2000,  c A-37 

3 AR  187/97 
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ATB’s  board  of  directors  approves  investment, 
derivative,  credit  and  financial  risk  management 
policies.  Management  implements  those  policies 
by  designing  systems,  processes  and  risk 
management  techniques  that  also  comply  with  the 
regulatory  framework  and  with  guidelines  issued 
by  the  Minister.  Three  of  these  guidelines4  relate 
specifically  to  treasury  management: 

• liquidity 

• prudent  person  rule 

• derivatives  best  practices 

Financial  institution  treasury  risks 

As  a financial  institution,  ATB  is  exposed  to: 

• credit  risk — that  a counterparty  will  cause  a 
financial  loss  for  ATB  by  failing  to  discharge  a 
financial  or  contractual  obligation 

• market  risk — that  ATB  may  incur  a loss  caused 
by  adverse  changes  in  market  prices 

• foreign  currency  risk — that  ATB  may  incur  a 
loss  caused  by  changes  in  foreign  exchange 
rates 

• interest  rate  risk — that  ATB  may  incur  a loss 
caused  by  changes  in  market  interest  rates 

• liquidity  risk — that  ATB  will  be  unable  to  meet 
its  obligations  as  they  come  due  or  will  be 
unable  to  fund  itself  at  economical  levels 

Board  oversight  committee  and  senior 
management  committees 
The  main  responsibility  for  managing  ATB’s 
treasury  risks  rests  within  its  treasury  department. 
The  Risk  Management  Group  monitors  risk  and 
provides  reporting  to  senior  management.  The 
management  committee  that  oversees  treasury 
risk  management  is  ALCO.  The  board  of  directors 
oversees  treasury  risk  management  through  the 
board’s  Risk  Committee. 

ALCO  is  responsible  for  the  oversight  and  strategic 
management  of  ATB's  financial  risks,  including 
interest  rate,  liquidity  and  foreign  exchange,  as 
well  as  funding  and  investing,  capital  planning 
and  any  other  aspects  of  strategic  balance  sheet 


4 http://atb.com/Dev/aboutatb/atb_regulatory_framework  asp 


management,  asset  liability  management  and 
associated  hedging  strategies. 

The  responsibilities  of  the  board’s  Risk  Committee 
include: 

• reviewing  and  recommending  to  the  board  of 
directors  reasonable  and  prudent  investment 
and  lending  policies,  standards  and  procedures 
to  avoid  undue  credit  risk  and  potential  loss 

• reviewing  and  recommending  to  the  board  of 
directors  credit  risk  management  policies  for 
approval  by  the  board 

• reviewing  and  recommending  to  the  board  of 
directors  policies  related  to  risks  surrounding 
asset  liability  management,  liquidity,  interest 
rate  management,  foreign  exchange  and  the 
investment  portfolio 

• annually  reviewing  the  effectiveness  and 
application  of  market  risk  management  and 
liquidity  risk  management  policies,  standards 
and  procedures 


Findings  and  recommendations 


We  present  our  audit  findings  under  the  four 
categories  of  recommendations  from  our  October 
2008  Report — investments  (see  below),  liquidity 
(see  page  47),  interest  rate  risk  (see  page  48) 
and  other  recommendations  (see  page  50). 

Investments 

As  part  of  our  October  2008  Report,  we  examined 
certain  decisions  ATB  made  in  2007  leading  up 
to  the  disruption  in  the  asset-backed  commercial 
paper  market  that  occurred  in  Canada  in 
August  2007.  At  the  time  of  the  disruption,  ATB 
held  approximately  $1.1  billion  in  third-party  ABCP 
investments.  In  2008,  we  noted: 

• ATB’s  investment  policy  allowed  ATB  to 
have  exposure  up  to  60%,  or  approximately 
$1 .8  billion  of  its  $3  billion  investment  portfolio 
in  the  commercial  paper  asset  class,  which 
includes  ABCR 

• ABCP  investments  were  considered  investment 
grade  by  investors  because  of  the  R1  -high  or 
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triple-A  ratings  issued  by  a credit  rating  agency, 
and  no  other  credit  analysis  was  done  by  ATB 

• ATB  did  not  actively  monitor  credit  risk  of  its 
investment  counterparties 

• ATB  received  a minimally  higher  return  from 
investing  in  third-party  ABCP  compared  to 
other  acceptable  investments  under  the 
investment  policy. 

• ATB  chose  to  invest  in  third-party  ABCP  to 
achieve  increasing  treasury  performance 
targets.  The  variable  pay  program  for  ATB 
employees  responsible  for  purchasing  ATB  s 
investments  was  also  partially  based  on 
achieving  these  targets 

As  at  December  31,  2010,  ATB  s asset-backed 
commercial  paper  holdings  had  a face  value 
of  approximately  $1  billion  and  a fair  value  of 
approximately  $620  million.  We  will  not  know  the 
actual  cash  loss  of  capital  and  interest  until  these 
notes  mature,  which  is  expected  to  be  in  2016. 
Below  are  the  results  of  our  follow-up  of  our  three 
recommendations  related  to  ATB's  investment 
processes. 

Business  rules  and  operating 
procedures — implemented 

Background 

In  our  October  2008  Report  (no  1 2 — page  1 1 8),  we 
recommended  that  ATB  develop  and  document  the 
business  rules  and  operating  procedures  required 
to  implement  its  investment  policy. 


Our  audit  findings 

ATB  implemented  this  recommendation  by 
improving  its  business  rules  and  operating 
procedures  for  investments.  Specifically,  ATB 

• has  reduced  the  maximum  exposure  allowed 
per  individual  counterparty  and  the  allowable 
exposure  to  the  commercial  paper  asset  class, 
which  includes  ABCP 

• requires  credit  analysis  of  counterparties  before 
they  are  added  to  the  approved  investment 

list  and  has  increased  the  required  number  of 
credit  rating  agency  ratings  to  two 


• uses  an  early  warning  system  to  actively 
monitor  credit  risk  of  its  counterparties 

ATB  has  implemented  the  improved  business  rules 
and  operating  procedures 

Performance  targets — changed 
circumstances 

Background 

In  our  October  2008  Report  (page  123),  we 
recommended  that  ATB  improve  its  process  for 
establishing  performance  targets  for  employees  in 
its  Global  Financial  Markets  group,  by  discussing 
the  targets  with  ALCO  and  maintaining  evidence 
that  supports  decisions  made 


Our  audit  findings 

ATB  reorganized  Global  Financial  Markets  into 
another  treasury  area  within  ATB  and  the  new 
area  no  longer  has  performance  targets  linked  to 
investment  returns  The  performance  targets  are 
now  based  on  corporate  performance  targets  This 
recommendation  is  no  longer  relevant  because 
staff  who  purchase  investments  are  no  longer 
compensated  based  on  investment  performance 

Variable  pay  program — changed 
circumstances 

Background 

In  our  October  2008  Report  (page  125),  we 
recommended  that  ATB  complete  its  business 
rules  on  how  to  calculate  variable  pay  for  Global 
Financial  Markets  staff,  by  clarifying  how  to  deal 
with  revenue  not  collected  and  with  investment 
losses 

Our  audit  findings 

ATB  removed  performance  targets  linked  to 
investment  returns  from  its  variable  pay  program  for 
individuals  who  purchase  investments  Therefore, 
this  recommendation  is  no  longer  relevant  because 
these  employees  are  no  longer  compensated 
based  on  investment  performance 
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Liquidity 

Liquidity  reporting — implemented 

Background 

In  our  October  2008  Report  (page  127),  we 
recommended  that  ATB  agree  internally  on  a 
consistent  measure  of  liquidity  and  report  that 
measurement  to  its  board  and  to  the  Department, 
to  provide  regular  and  fair  reporting. 


Our  audit  findings 

ATB  implemented  this  recommendation  by 
standardizing  the  way  it  calculates  liquidity.  ATB’s 
liquidity  policy  clearly  identifies  how  liquidity 
is  calculated.  ATB’s  funding  group  within  the 
Treasury  Department  reports  current  liquidity  levels 
monthly  to  ALCO  and  quarterly  to  the  board.  The 
Department  also  receives  this  information. 

Liquidity  contingency  plan — implemented 

Background 

In  our  October  2008  Report  (no.  13 — page  129),  we 
recommended  that  ATB  develop  a comprehensive 
liquidity  contingency  plan  to  be  better  prepared 
for  a liquidity  crisis  and  to  fully  comply  with  the 
Minister’s  liquidity  guideline.  The  plan  should  be 
updated  and  approved  regularly. 

A liquidity  contingency  plan  describes  an 
organization’s  approach  to  funding  and  to  abnormal 
liquidity  situations.  The  Minister’s  liquidity  guideline 
contains  specific  items  that  should  be  included  in 
ATB’s  liquidity  contingency  plan.  These  guidelines 
are  intended  to  help  regulated  entities  like  ATB 
ensure  they  have  and  maintain  an  adequate 
liquidity  contingency  plan;  however,  they  are  not 
mandated  to  be  followed. 


Our  audit  findings 

ATB  implemented  this  recommendation  by 
including  the  following  in  its  liquidity  contingency 
plan: 

• specific  procedures  that  outline  information  flow 
to  senior  management 

• clear  division  of  responsibilities 


• priority  of  alternative  sources  of  funds 

• elevation  procedures  when  liquidity  limit 
breaches  occur 

Although  ATB’s  liquidity  contingency  plan  has 
been  improved,  it  does  not  fully  comply  with  the 
Minister’s  liquidity  guideline.  ATB  concluded 
some  requirements  of  the  guideline  are  no  longer 
relevant.  We  agree  with  ATB’s  conclusions  and 
consider  this  recommendation  to  be  implemented. 

Liquidity  simulations — satisfactory 
progress 

Background 

In  our  October  2008  Report  (page  128),  we 
recommended  that  ATB  further  expand  its  use  of 
liquidity  simulations  as  a forward-looking  liquidity 
risk  measurement  tool.  We  also  recommended 
that  ALCO  and  the  board’s  oversight  committee 
consider  whether  the  results  of  liquidity  simulations 
indicate  a need  to  modify  ATB’s  business  plan. 

Liquidity  simulations  are  a tool  management  uses 
to  support  liquidity  management  and  funding 
decisions.  If  these  simulations  are  not  done,  ATB 
may  be  limited  in  its  ability  to  anticipate  and  deal 
with  potential  liquidity  disruptions. 


Our  audit  findings 


Key  Point 


ATB  is  not  complying  with  its  Liquidity  Risk 
Management  Policy  that  requires  liquidity  simulations 
to  be  done  quarterly 

ATB  made  satisfactory  progress  implementing  this 
recommendation.  ATB  now  annually  performs  the 
following  liquidity  simulations: 

• global  systemic — a widespread  lack  of 
consumer  confidence  in  the  global  financial 
services  market 

• Canadian  systemic — a widespread  lack  of 
consumer  confidence  in  the  Canadian  financial 
services  market 

• ATB  specific — events  that  do  not  impact  other 
financial  institutions 
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To  fully  implement  this  recommendation.  ATB  must 
perform  its  liquidity  simulations  at  least  quarterly  to 
comply  with  its  Liquidity  Risk  Management  Policy. 
February  2010 


Implications  and  risks  if  recommendation 
not  implemented 

ATB  may  limit  its  ability  to  anticipate  and  develop 
strategies  to  deal  with  potential  liquidity  disruptions 
by  not  implementing  expanded  liquidity  simulations 
as  a regular  part  of  its  liquidity  risk  management 
process. 

Interest  rate  risk 

Interest  rate  risk  reporting — implemented 

Background 

In  our  October  2008  Report  (no.  14 — page  131), 
we  recommended  that  ATB  provide  more  qualitative 
and  quantitative  reporting  to  senior  management 
and  the  board  on  its  interest  rate  risk  management. 

ATB's  objective  for  managing  interest  rate  risk 
is  to  achieve  stable  earnings  and  value  growth 
through  active  management  of  its  asset  (loans 
and  securities)  and  liability  (deposits)  positions. 

In  practice,  this  is  achieved  through  interest  rate 
hedging  strategies  designed  to  minimize  the  impact 
that  changes  in  interest  rates  would  have  on  net 
interest  income  and  maintain  the  effects  of  changes 
in  interest  rates  within  a target  limit  of  net  income. 

This  information  allows  management  to  make 
strategic  decisions  and  develop  appropriate 
risk  mitigation  strategies  on  interest  rate 
risk  management.  We  reported  in  2008  that 
management  provided  limited  reporting 
to  ALCO  and  the  board  of  directors. 


Our  audit  findings 

ATB  implemented  this  recommendation  by 
improving  the  interest  rate  risk  information 
provided  to  ALCO  and  the  board  We  attended  the 
September  2010  meeting  of  ALCO  and  observed 
that  the  committee's  monthly  materials  contain  the 
major  sources  of  interest  rate  risk  exposure  to  ATB 
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and  explain  movements  in  interest  rate  sensitivity 
from  one  reporting  period  to  the  next  This  reporting 
also  includes  ATB  s compliance  with  policy  limits 
Similar  reporting  is  provided  to  the  board  of 
directors 

We  are  satisfied  that  ATB  now  reports  sufficient 
qualitative  and  quantitative  information  on  its 
interest  rate  exposure  However,  as  we  note  under 
the  headings  Interest  rate  risk  model  assumptions 
(below)  and  Interest  rate  risk  modeling  and  stress 
testing  (see  page  49),  the  processes  to  support 
underlying  data  used  in  the  interest  rate  risk 
management  reports  need  improvement 

Interest  rate  risk  model  assumptions — 
recommendation  repeated 

We  repeat  this  recommendation  because  ATB 
has  not  made  sufficient  progress  improving  its 
processes  for  creating,  applying  and  validating 
assumptions  used  in  its  interest  rate  risk  models 


Recommendation:  interest  rate  risk  model 
assumptions 


RECOMMENDATION  NO.  1— REPEATED 


We  again  recommend  that  Alberta  Treasury 
Branches  improve  processes  for  creating, 
applying  and  validating  assumptions  used  in  its 
interest  rate  risk  models 


Background 

We  first  made  this  recommendation  in  our 
October  2008  Report  (page  132) 

Interest  rate  risk  modeling  provides  management 
with  information  to  evaluate  how  sensitive  ATB's 
net  income  and  the  value  of  its  balance  sheet 
are  to  changes  in  interest  rates  Management 
develops  product  pricing  and  hedging  strategies 
based  on  the  information  from  its  modeling 
process  For  example,  management  makes 
decisions  to  purchase  derivatives  to  hedge 
interest  rates  based  on  model  output 

Interest  rate  risk  modeling  is  an  assumption-driven 
process  Assumption  risk  represents  a significant 
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risk  to  the  measurement  of  interest  rate  risk 
and  can  potentially  result  in  very  different  risk 
measurements.  For  financial  institutions,  the 
preferred  method  of  developing  modeling 
assumptions  is  to  collect  and  perform  analysis  of 
historical  data.  Analytical  approaches  are  used 
to  perform  analysis  of  the  data  with  the  objective 
of  defining  scenario  specific  assumptions.  All 
assumptions  become  dated  overtime,  soATB 
must  continuously  collect  and  validate  data  to 
calibrate  the  assumptions  when  required. 


Criteria:  the  standards  for  our  audit 

ATB  should  have  effective  processes  for  creating, 
applying  and  validating  assumptions  used  in  its 
interest  rate  risk  models. 


Our  audit  findings 


Key  Point 


ATB  has  not  done  enough  to  ensure  the  assumptions 
used  in  its  interest  rate  risk  modeling  are  accurate  and 
validated  periodically 

ATB  does  not  have  a process  to  periodically 
validate,  through  the  analysis  and  review  of 
historical  data,  important  assumptions  used  in  its 
models.  In  2009,  ATB  performed  an  analysis  that 
focused  on  certain  assumptions.  The  level  and 
frequency  of  analysis  of  historical  data  used  to 
review  and  validate  other  important  assumptions 
is  not  yet  at  a level  that  would  allow  us  to 
conclude  satisfactory  progress  has  been  made. 

All  assumptions  become  dated  over  time,  so  it 
is  critical  to  provide  for  the  ongoing  collection  of 
data  and  periodic  analysis  of  data  to  calibrate  the 
assumptions. 

ATB's  progress  has  been  limited  because 
resources  in  the  asset  liability  management  group 
are  seconded  to  work  on  its  new  banking  system 
implementation.  ATB  told  us  that  no  formal  plan  or 
project  currently  exists  to  demonstrate  how  it  will 
ensure  its  assumptions  are  validated  on  a regular 
basis. 


To  implement  this  recommendation,  ATB  must: 

• develop  a recurring  process  to  analyze 
important  model  assumptions  to  ensure  they 
are  accurate  and  fit  the  characteristics  of  ATB 
products  and  customers 

• establish  a change  control  process,  which 
would  include  a process  to  review,  update  and 
approve  significant  changes  to  assumptions 
used  in  its  models 

• create  a process  for  validating  model 
assumptions  through  back-testing  or 
comparisons  of  significant  assumptions  to 
actual  results 


Implications  and  risks  if  recommendation 
not  implemented 

Management  may  make  incorrect  product  pricing 
and  risk  mitigation  decisions  if  the  assumptions  for 
modeling  interest  rate  risks  are  inaccurate  and  lead 
to  unreliable  information. 

Interest  rate  risk  modeling  and  stress 
testing — satisfactory  progress 

Background 

In  our  October  2008  Report  (page  134),  we 
recommended  that  ATB  define  its  significant 
interest  rate  risk  exposures  and  model  those 
significant  exposures  to  assess  the  effects  on 
future  financial  results. 

Interest  rate  risk  modeling  and  stress  testing 
provides  management  with  insights  into 
determining  the  impact  of  scenarios  on  the 
organization  and  assessing  what  scenarios  may 
be  potentially  stressful  to  the  organization.  This 
helps  management  develop  meaningful  strategies 
to  deal  with  these  scenarios.  Additionally,  stress 
testing  allows  management  to  identify  early 
warning  signals  that  management  can  monitor 
to  determine  if  a stress  scenario  is  developing. 
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Our  audit  findings 


Key  Points 


• ATB  does  not  regularly  perform  interest  rate  stress 
testing 

• ATB  has  not  completed  its  analysis  of  basis  and 
option  risks 

ATB  has  made  satisfactory  progress  implementing 
this  recommendation 

ATB  has  started  to  define  its  basis5  and  option6 
risk  exposures  through  the  creation  of  an  inventory 
of  products,  which  identifies  where  basis  and 
option  risk  exists  ATB  cannot  fully  implement  our 
recommendation  because  its  current  information 
systems  do  not  contain  sufficient  data  to  allow  an 
effective  analysis  to  be  completed  of  option  and 
basis  risk  exposures  ATB  expects  it  will  have 
this  information  when  its  new  banking  system  is 
implemented 

ATB  has  defined  the  relevant  interest  rate  risk 
stress  scenarios  that  it  feels  are  appropriate 
However,  it  has  not  run  these  scenarios  because  of 
resource  constraints  ATB  expects  to  be  able  to  run 
these  scenarios  once  the  new  banking  system  is 
implemented. 

To  fully  implement  this  recommendation,  ATB  must 
complete  its  analysis  of  option  and  basis  risk,  and 
perform  its  stress  testing  scenarios  regularly. 


Implications  and  risks  if  recommendation 
not  implemented 

If  ATB  does  not  perform  periodic  scenarios  to 
evaluate  its  potential  interest  rate  risk  exposure 
from  different  sources,  management  may  not 
be  fully  aware  of  its  interest  rate  risk  exposures, 
resulting  in  unexpected  financial  losses. 

5 Basis  risk  occurs  in  variable  interest  rate  products  when 
the  interest  rate  spread  between  two  different  rates  widens 
or  contracts.  Since  variable  rate  products  are  indexed  to 
either  a market  index  or  an  internally  managed  rate,  certain 
indices  may  lag  the  market  rate  movements,  which  can 
slow  or  accelerate  the  impact  of  basis  risk 

6 Option  risk  occurs  when  a customer  or  the  financial 
institution  has  the  ability  to  alter  transaction  terms  and  cash 
flows  In  general,  options  will  only  be  exercised  if  there  is  a 
benefit  to  be  gained  by  the  holder  of  the  option  Common 
examples  of  product  options  are  prepayments  for  loans  or 
interest  rate  commitments 
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Other  recommendations 

Role  of  ALCO — implemented 

Background 

In  our  October  2008  Report  (no  15 — page  142), 
we  recommended  that  ATB  review  the  role  of  ALCO 
and  consider  restructuring  it  into  two  tiers 

Our  audit  findings 

ATB  implemented  this  recommendation  by  creating 
terms  of  reference  for  ALCO  that  outlined  the 
committee  s responsibility  for  the  oversight  and 
strategic  management  of  ATB  s treasury  nsks 
ALCO's  revised  structure  allows  it  to  strategically 
focus  on  treasury  risk  management  decisions  We 
reviewed  the  committee  s minutes  and  attended  the 
September  2010  ALCO  meeting  and  observed 

• the  focus  of  the  committee  has  moved  from 
tactical  to  strategic 

• attendance  by  senior  management  was  good, 
representing  all  significant  lines  of  business 

• strategies  were  discussed  and  approved 

• appropriate  discussions  were  held  on  nsk 
management,  asset  liability  management 
liquidity  and  updates  on  the  significant  lines  of 
business 

Internal  audit  program — implemented 

Background 

In  our  October  2008  Report  (page  143),  we 
recommended  that  ATB  s internal  auditors  regularly 
examine  all  types  of  ATB's  derivative  activities,  to 

• promptly  identify  and  rectify  internal  control 
weaknesses 

• fully  comply  with  the  Department's  guideline  for 
derivatives  best  practices 

Our  audit  findings 

ATB's  internal  audit  department  implemented 
this  recommendation  by  adopting  a risk-based 
approach  that  prioritizes  its  audit  work,  including 
derivatives,  based  on  an  enterprise-wide  risk 
assessment  This  process  classifies  all  areas 
at  ATB  by  risk;  internal  audit  uses  these  risk 
assessments  to  determine  upcoming  audit  work 
In  response  to  this  risk  assessment,  internal  audit 
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has  planned  a derivative  focused  audit  for  fiscal 
2011.  In  2009,  internal  audit  also  performed  an 
audit  of  interest  rate  management  that  included 
derivatives. 

Treasury  policies — satisfactory  progress 

Background 

In  our  October  2008  Report  (page  1 39),  we 
recommended  that  ATB  implement  the  updated 
investment  and  derivatives  policies  for  changes 
arising  from  its  recent  review  of  those  policies.  We 
also  recommended  that  ATB  review  its  financial  risk 
management  policy. 


Our  audit  findings 


Key  Points 


• ATB  has  not  completed  annual  reviews  and 
updates  to  its  treasury  policies 

• Some  treasury  policies  do  not  reflect  the  current 
organizational  structure  within  ATB's Treasury 
department 

ATB  has  made  satisfactory  progress  implementing 
this  recommendation.  ATB  updated  and 
implemented  its  policies  in  late  2008.  The 
improvements  to  the  policies  included: 

• splitting  the  derivative  policy  to  take  into 
account  separate  programs  around  corporate 
and  client  derivatives 

• incorporating  clearer  roles  and  responsibilities 
around  reporting 

• clearly  stating  ATB’s  investment  objectives  and 
risk  philosophy 

• adopting  more  stringent  requirements,  such 
as  multiple  external  credit  ratings,  before  an 
investment  could  be  added  to  the  approved 
investment  listing 

However,  some  policies  have  not  been  reviewed 
and  updated  since  2008.  The  policies  state  they 
are  to  be  reviewed  on  at  least  an  annual  basis  by 
ATB’s  board  of  directors.  The  policies  that  have  not 
been  reviewed  annually  are: 

• Treasury  Derivatives  Risk  Management  Policy- 
August  2008 

• Client  Derivatives  Risk  Management  Policy- 
August  2008 


• Investment  Risk  Management  Policy- 
August  2008 

• Interest  Rate  Risk  Management  Policy- 
May  2009 

We  noted  through  our  audit  that  policies  last 
updated  in  2008  refer  to  areas  within  ATB  that  were 
restructured.  In  the  absence  of  up-to-date  policies, 
roles  and  responsibilities  may  not  be  clear  and  the 
policies  become  ineffective. 

To  fully  implement  this  recommendation,  ATB  must 
keep  its  treasury  policies  current  through  at  least 
annual  reviews  and  updates. 


Implications  and  risks  if  recommendation 
not  implemented 

Management  decisions  and  actions  may  not  be 
within  ATB’s  risk  tolerance  if  policies  are  not  clear 
and  up  to  date. 
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ME  first!  program — satisfactory 
progress 

Background 

In  our  October  2008  Report  (no.  37 — page  335), 
we  recommended  that  the  Department  of  Municipal 
Affairs  (Department)  assess  the  effect  of  energy 
savings  on  greenhouse  gas  emissions.  The  energy 
savings  were  anticipated  from  projects  funded 
by  the  Department’s  ME  first!  program.  We  also 
recommended  that  the  Department  report  lessons 
learned  from  this  program  to  departments  involved 
in  creating  climate  change  programs. 

This  year,  we  conducted  a follow-up  audit  to 
assess  the  Department’s  progress  in  implementing 
our  recommendation.  We  reviewed  the  reports 
the  Department  received  on  projects  funded 
by  the  ME  first!  program.  We  also  reviewed  the 
Department’s  reporting  of  the  lessons  learned  to 
other  departments. 


Our  audit  findings 

The  Department  continues  to  follow  up  with 
municipalities  to  obtain  Energy  Reduction 
Confirmation  Reports  (ERCRs)  for  all  projects  that 
have  been  completed  for  one  year  or  more.  This 
represents  77  projects  out  of  the  original  84,  and 
56%  of  the  total  loan  value  as  of  December  2010. 

The  remaining  seven  projects  funded  in  2004  and 
2007  are  not  complete;  therefore,  the  ERCRs 
have  not  been  prepared  by  the  municipalities.  The 
Department  needs  to  continue  to  monitor  these 
projects  to  ensure  compliance  with  the  program 
requirements,  as  they  make  up  a substantial 
portion  of  the  program. 

The  reporting  that  we  tested  from  the  municipalities 
on  the  energy  savings  realized  from  the  projects 
was  not  consistent.  For  example,  we  found  that 
one  municipality  reported  their  actual  energy  usage 
instead  of  savings  for  the  year. 


What  needs  to  be  done 

To  fully  implement  our  recommendation,  the 
Department  should  continue  to  monitor  the 
outstanding  projects  to  ensure  that  municipalities 
obtain  consistent  energy  savings  information  for  all 
projects. 

At  the  conclusion  of  the  program,  the  Department 
should  update  the  report  on  the  lessons  learned 
based  on  an  overall  assessment  of  the  program, 
including  an  analysis  of  total  costs,  benefits 
generated  and  an  identification  of  improvements 
that  could  be  incorporated  if  a similar  program  is 
considered  in  the  future. 
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Summary 


Confined  feeding  operations  (CFOs)1  are  enclosed 
areas  where  operators  confine  livestock  for  the 
purpose  of  growing,  finishing  or  breeding  them. 
Alberta  has  about  2,000  CFOs. 

Natural  Resources  Conservation  Board  (NRCB) 
assumed  responsibility  for  administering  the 
Agricultural  Operation  Practices  Act  (AOPA)2 
effective  January  1,  2002.  Prior  to  2002,  CFOs 
were  approved  and  regulated  by  municipalities  in 
accordance  with  municipal  requirements.  Over  half 
of  all  CFOs  in  NRCB’s  database  were  constructed 
before  2002. 

As  part  of  its  work,  NRCB  monitors  and  enforces 
compliance  with  the  AOPA,  to  ensure  that 
Alberta’s  CFOs  operate  in  an  environmentally 
sustainable  way. 

What  we  examined 

We  followed  up  on  recommendations  from  our 
2004  audit  and  2007  follow-up  audit  of  NRCB’s 
monitoring  of  confined  feeding  operations. 

In  our  October  2004  Report  (no.  28 — page  294), 
we  recommended  that  NRCB: 

• manage  odour  and  nuisance  complaints  more 
efficiently 

• rank  its  compliance  and  enforcement  activities 
based  on  risk 

• prepare  operational  plans,  at  the  division  level, 
that  integrate  with  its  annual  business  plan  and 
budget 


1 "Confined  feeding  operation  means  fenced  or  enclosed 
land  or  buildings  where  livestock  are  confined  for  the 
purpose  of  growing,  sustaining,  finishing  or  breeding 
by  means  other  than  grazing  and  any  other  building  or 
structure  directly  related  to  that  purpose,  but  does  not 
include  residences,  livestock  seasonal  feeding  and  bedding 
sites,  equestrian  stables,  auction  markets,  race  tracks  or 
exhibition  grounds.”  Section  1 (b.6)  Agricultural  Operation 
Practices  Act,  Chapter  A-7  RSA  2000 

2 Chapter  A-7,  RSA  2000 


In  2007,  we  found  that  NRCB  had  made  progress 
in  managing  nuisance  and  odour  complaints  and 
had  integrated  its  operational  and  business  plans. 
We  repeated  the  risk  analysis  part  of  our  2004 
recommendation  to  encourage  NRCB  to  consider 
the  merits  of  using  a comprehensive  environmental 
risk  assessment  approach  to  regulating  CFOs  (our 
October  2007  Report,  no.  34,  vol.  2 — page  167). 
Based  on  the  2007  audit  criteria,  we  outlined  four 
steps  NRCB  needed  to  take  to  implement  our 
recommendation. 

Why  it  is  important  to  Albertans 

AOPA  sets  out  mandatory  standards  that 
address  risks  to  the  environment  and  impacts  on 
communities.  The  major  risk  is  contamination  of 
groundwater  resource3  and  surface  water.  CFOs 
can  also  cause  unpleasant  odours  in  the  vicinity  of 
the  CFO. 

What  we  found 

More  efficient  approach  to  odour  and  nuisance 
complaints 

NRCB  implemented  our  2004  recommendation 
to  manage  odour  and  nuisance  complaints  more 
efficiently.  These  improvements  are  reflected  in  a 
new  odour  complaint  form. 

Risk-based  assessment  and  enforcement  of 
CFO  compliance 

Groundwater — NRCB  has  made  significant 
progress  with  designing  and  implementing  a 
risk-based  compliance  program  for  groundwater. 


In  2007,  NRCB  still  needed  to: 


1 

2011  Status 

Define,  through  research,  the  environmental  risks 
applicable  to  CFOs  and  their  impact 

Implemented 

Categorize  CFOs  by  priority  levels  of 
environmental  risk  at  different  locations 

Implemented 

Conduct  appropriate  sampling  and  testing  to 
confirm  the  validity  of  assigned  risk  levels 

Implemented 

Select  and  deliver  appropriate  compliance  and 
enforcement  action 

Satisfactory 

Progress 

3 Means  groundwater  resource  as  defined  in  AR  267/2001 , 
Section  (1 . 1 )(g.1 ) 
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Surface  water — we  intended  for  our  2004 
recommendation  (repeated  in  2007)  to  cover  both 
groundwater  and  surface  water  risks  However. 
NRCB  interpreted  our  recommendation  as  being 
solely  for  groundwater  risks,  as  many  of  our 
observations  were  about  groundwater.  We  found 
this  difference  in  interpretation  when  we  began  our 
current  follow-up 

NRCB  s system  for  assessing  surface  water  risks 
differs  from  its  risk-based  compliance  program  for 
groundwater  We  were  unable  to  find  evidence  that 
NRCB  s approach  will  detect  significant  surface 
water  risks  before  contamination  occurs  and  have, 
therefore,  made  a new  recommendation  to  NRCB 
for  surface  water  risks. 

What  remains  to  be  done 

Groundwater — To  fully  implement  our 
recommendation  to  assess  and  enforce  CFOs' 
compliance  based  on  groundwater  risk,  NRCB 
needs  to: 

• develop  a system  to  periodically  follow  up 
on  those  sites  it  categorizes  as  potentially 
high-risk  to  groundwater,  to  detect  if  risk 
levels  have  changed  as  a result  of  operational 
changes 

• demonstrate  that  it  is  enforcing  the  new 
groundwater  monitoring  and  reporting 
conditions 

Surface  water — NRCB  needs  to  obtain  evidence 
to  demonstrate  that  its  compliance  approach  will 
be  adequate  in  proactively  managing  surface  water 
risks. 


Findings  and  recommendations 


Efficiently  manage  odour  and 
nuisance  complaints — implemented 
Background 

In  our  October  2004  Report  (no.  28 — page  294), 
we  recommended  that  NRCB  manage  odour  and 
nuisance  complaints  more  efficiently 


Our  audit  findings 

NRCB  has  implemented  our  recommendation 
NRCB  uses  a new  odour  complaint  form  as  part 
of  its  complaint  resolution  process  The  form  helps 
compliance  staff  to  systematically  assess  the 
likely  causes  of  odours  and  respond  with  on-site 
inspections  only  when  necessary  As  a result 
NRCB  is  able  to  use  resources  more  efficiently 


Rank  compliance  and  enforcement 
activities  based  on  risk 


Define,  through  research  the  environmental  risks 
applicable  to  CFOs  and  their  impact  at  different  Implemented 
locations 

Categorize  CFOs  by  priority  levels  of 
environmental  risk 

Conduct  appropriate  sampling  and  testing  to 
confirm  the  validity  of  assigned  risk  levels 

Select  and  deliver  appropriate  compliance  and 
enforcement  action 


Surface  water — See  our  new  recommendation  for 
Surface  Water  Risks  on  page  59 

Groundwater  risks 

Background 

In  our  October  2007  Report  (no  34.  vol  2 — 
page  167)  we  repeated  our  2004  recommendation 
that  NRCB  rank  its  compliance  and  enforcement 
activities  based  on  environmental  risk 

Criteria:  the  standards  for  our  audit 

NRCB  should  focus  compliance  activities  on  CFOs 
that  represent  the  highest  environmental  risks  To 
do  this,  NRCB  should 

• identify  risk  criteria 

• use  the  criteria  to  rank  CFOs  and  identify  those 
in  higher  risk  locations 

• assess  samples  of  CFOs  in  higher  risk 
locations  and  conduct  comprehensive 
assessments  to  confirm  if  NRCB's  risk  criteria 
are  valid  and  the  risks  are  actually  present 

• test  to  detect  changes  in  risk  levels  over  time 

• conclude  on  the  prevalence  and  impact  of  risks 


Implemented 

Implemented 

Satisfactory 

Progress 
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NRCB  should  gather  enough  information  to  decide 
whether  to  take  additional  compliance  action. 


Our  audit  findings 


Key  Points 


NRCB  has  significantly  improved  its  risk-based 
assessment  of  groundwater  compliance,  but  has  not 
yet: 

• developed  a system  of  random  periodic 
inspections  to  detect  whether  CFOs'  risks  change 
in  locations  defined  as  potentially  high  risk 

• completed  a full  cycle  of  monitoring  and  enforcing 
compliance  with  the  new  monitoring  and  reporting 
conditions 

Our  assessment  of  NRCB’s  progress  for  each  part 
of  our  recommendation  for  groundwater  risks  is 
provided  below: 

Define,  through  research,  the  environmental 
risks  applicable  to  CFOs  and  their  impacts — 
implemented 

NRCB  reviewed  a report  commissioned  by  the 
Department  of  Agriculture  and  Rural  Development 
(ARD),  which  provided  a comprehensive  review  of 
research  studies  and  other  literature  on  the  effect 
of  manure  storage  at  CFOs  on  groundwater  quality. 
The  report  indicated  that  Alberta  should  have  many 
sites  where  the  hydrogeology  is  suitable  for  CFOs, 
because  there  are  relatively  thick  clay  deposits  over 
much  of  the  province  and  relatively  few  extensive, 
shallow  aquifer  systems.  However,  the  report  also 
confirmed  that  “soil  and  groundwater  contamination 
can  occur  from  CFOs." 

NRCB  used  information  from  a variety  of 
sources,  including  ARD’s  report,  to  develop  an 
environmental  risk  screening  tool  for  assessing  and 
ranking  CFOs  as  high,  medium  or  low  risk,  for  both 
groundwater  and  surface  water  contamination.  The 
risk  screening  tool  identifies  and  quantifies  key  risk 
factors. 


Categorize  CFOs  by  priority  levels  of 
environmental  risk — implemented 

NRCB  uses  two  approaches  to  categorizing  CFOs 
by  groundwater  risk.  In  the  first,  NRCB  rates  a 
CFO’s  preliminary  risk  as  high  for  groundwater  if 
the  feeding  operation: 

• stores  liquid  manure  in  a lagoon 

• was  built  before  2002,  when  construction 
details  are  not  always  available 

• is  in  an  area  of  high  groundwater  vulnerability 
(according  to  groundwater  vulnerability  maps) 

To  make  its  preliminary  evaluation,  NRCB  staff 
review  file  documentation,  but  do  not  visit  the  CFO 
or  contact  the  operators.  Through  this  review, 
NRCB  identified  that  there  are  172  CFOs  with  a 
preliminary  high-risk  rating  for  groundwater.  NRCB 
plans  to  assess  these  high-risk  CFOs  using  the 
groundwater  section  of  its  risk  screening  tool  as 
part  of  its  compliance  and  enforcement  program. 

In  its  second  initiative,  NRCB  used  the  risk 
screening  tool  to  assess  the  risk  of  234  CFOs  that 
had  groundwater  monitoring  requirements  in  their 
permits. 

NRCB  will  categorize  the  remaining  CFOs  as 
potentially  low-risk  for  groundwater  and  will  not 
assess  these  CFOs  using  the  risk  screening  tool. 

Conduct  appropriate  testing  to  confirm  the 
validity  of  assigned  risk  levels — implemented 

NRCB  has  tested  its  risk  assessment  tools  to 
confirm  that  they  are  well-designed.  NRCB 
has  also  tested  its  risk  categorization  process 
used  to  classify  CFOs  by  priority  levels  of  risk 
to  groundwater.  NRCB  selected  a sample  of 
18  CFOs  to  test  the  risk  screening  tool  in  the  field 
and  confirm  whether  the  preliminary  screening 
effectively  identifies  potential  groundwater  risk. 

To  do  this,  NRCB  identified  16  CFOs  rated  as 
potentially  high  groundwater  risk,  and  added  two 
low  groundwater  risk  CFOs  as  control  sites.  At 
the  conclusion  of  our  audit,  NRCB  had  completed 
assessments  using  the  risk  screening  tool  at 
13  CFOs  and  was  working  on  the  remaining  five. 
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The  results  suggest  that  the  preliminary  screening 
effectively  identifies  groundwater  risks 

NRCB  also  used  its  assessment  of  234  CFOs 
under  the  leak  detection  program  to  confirm  that 
groundwater  vulnerability  mapping  is  an  accurate 
way  to  categorize  facilities  with  earthen  manure 
storage  systems. 

To  improve  its  understanding  of  groundwater 
risk,  NRCB  is  partnering  with  the  Department  of 
Agriculture  and  Rural  Development  in  a long-term 
study  of  the  effects  of  manure  storage  on 
groundwater  quality  under  different  hydrogeological 
conditions. 

Select  and  deliver  appropriate  compliance  and 
enforcement  action — satisfactory  progress 

In  our  October  2007  Report  (page  168),  we 
observed  that  NRCB  had  not  defined  what 
constituted  a serious  contravention  requiring  further 
enforcement.  NRCB  has  now  defined  this  in  its 
compliance  and  enforcement  policy. 

We  also  noted  in  2007  that  a significant  number 
of  CFO  operators  who  were  required  to  send 
groundwater  monitoring  reports  to  NRCB  had  failed 
to  do  so.  NRCB  needs  this  information  to  ensure 
that  CFO  operators  comply  with  groundwater 
monitoring  and  reporting  conditions  outlined  in  their 
perm  its.  * 

In  our  current  follow-up,  we  found  that  NRCB  has 
significantly  improved  its  groundwater  monitoring 
program  and  has  assessed  all  234  CFOs  that  have 
groundwater  monitoring  conditions  in  their  permits. 
By  the  end  of  our  audit,  NRCB  had  completed  the 
assessments  and  was  amending  permits  for  these 
CFOs  as  needed 

As  part  of  its  compliance  and  enforcement 
program,  NRCB  plans  to  use  the  groundwater 
section  of  its  risk  screening  tool  to  assess  the 
172  CFOs  identified  during  the  categorization 

4 The  Agricultural  Operation  Practices  Act  requires  operators 
to  obtain  a permit  from  NRCB  to  develop  and  operate 
a CFO,  before  setting  up  the  operation  Chapter  A-7, 

RSA  2000 
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process  These  assessments  include  visits  to  CFOs 
and  examination  of  structures  By  the  end  of  our 
audit,  NRCB  had  completed  13  assessments  and 
planned  to  perform  the  remaining  assessments  at  a 
rate  of  approximately  25  risk  screenings  per  year 

NRCB  needs  to  develop  a system  to  periodically 
follow  up  on  those  sites  that  are  categorized  as 
potentially  high-risk  to  groundwater,  to  detect  if 
risk  levels  have  changed  as  a result  of  operational 
changes 

To  fully  implement  this  part  of  our  recommendation, 
NRCB  needs  to 

• monitor  and  enforce  compliance  with  the 
new  groundwater  monitoring  and  reporting 
conditions 

• complete  the  assessments  planned  for  the 
potentially  high-risk  CFOs  for  the  first  one-year 
cycle 

• develop  a system  to  periodically  follow  up  on 
CFOs  as  potentially  high  risk  to  groundwater 

Surface  water  risks 

Background 

In  our  October  2007  Report  (vol  2 — page  167), 
we  indicated  four  elements  of  a risk-focused 
compliance  model 

• define,  through  research,  the  environmental 
risks  applicable  to  CFOs  and  their  impact 

• categorize  CFOs  by  priority  levels  of 
environmental  risk  at  different  locations 

• conduct  appropriate  sampling  and  testing  to 
confirm  the  validity  of  assigned  risk  levels 

• select  and  deliver  appropriate  compliance  and 
enforcement  action 

When  we  made  our  recommendation  in  2007, 
we  intended  for  it  to  cover  both  groundwater  and 
surface  water  risks  However,  NRCB  interpreted 
our  recommendation  as  being  solely  for 
groundwater  risks,  as  many  of  our  observations 
were  about  groundwater  We  detected  this 
difference  in  interpretation  when  we  began  our 
current  follow-up  NRCB  s system  for  assessing 
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surface  water  risks  differs  from  its  risk-based 
compliance  program  for  groundwater. 

Some  environmental  risk  factors  for  CFOs  are  not 
likely  to  change,  while  others  may  change  over 
time.  For  example,  soil  type,  distance  and  slope  to 
surface  water  bodies  are  not  likely  to  change.  On 
the  other  hand,  a change  in  the  type  and  number  of 
animals,  inadequate  maintenance  of  manure  run-off 
controls,  new  construction  or  changes  to  existing 
structures  may  all  contribute  to  changes  in  a CFO's 
surface  water  risk  level.  Overall,  risk  factors  for 
surface  water  are  more  likely  to  change  than  are 
those  for  groundwater. 

AOPA  establishes  standards  for  CFO  structures 
to  prevent  contamination  of  surface  water,  but 
only  up  to  a certain  level  of  risk.  For  example,  a 
catch  basin  must  have  a storage  capacity  that  can 
accommodate  at  least  a one-day  rainfall  that  has 
a one  in  30  year  probability.5  More  severe  rainfall 
events  may  result  in  surface  water  run-off  at  CFOs. 


Recommendation:  surface  water  risks 


RECOMMENDATION  NO.  2 


We  recommend  that  the  Natural  Resources 
Conservation  Board  demonstrate  that  its 
compliance  approach  is  adequate  in  proactively 
managing  surface  water  risks. 


Criteria:  the  standards  for  our  audit 

In  a program  designed  to  detect  significant  surface 
water  risks  before  contamination  occurs,  we  expect 
to  see  tests  to  demonstrate  that  the  approach  will 
work  as  planned. 


Our  audit  findings 


Key  Points 


• NRCB  needs  to  demonstrate  that  its  approach  to 
surface  water  risks  will  be  adequate 

• Current  compliance  approach  to  surface  water 
contamination  is  reactive,  not  proactive 

Through  research,  NRCB  developed  a screening 
tool  for  assessing  and  ranking  CFOs  as  high, 

5 Agricultural  Operation  Practices  Act,  Standards  and 
Administration  Regulation,  Section  19(2) 


medium  or  low  risk  for  surface  water  contamination. 
The  risk  screening  tool  identifies  and  quantifies  key 
risk  factors.  For  example,  risk  factors  for  surface 
water  include  the  type  and  amount  of  manure 
produced,  distance  and  slope  to  nearby  water 
bodies,  soil  type  and  texture,  type  and  condition  of 
manure  run-off  barriers,  and  certainty  of  available 
information. 

The  focus  of  NRCB’s  risk-based  compliance 
program  is  groundwater.  If  staff  identify  a potential 
surface  water  issue  at  these  sites,  they  may  also 
complete  the  surface  water  section  of  the  risk 
screening  tool.  However,  NRCB  does  not  plan 
to  use  the  tool  to  systematically  assess  CFOs 
by  levels  of  environmental  risk  for  surface  water. 
Nor  does  it  plan  to  conduct  periodic  sampling  and 
testing  of  CFOs  for  surface  water  risk. 

During  this  follow-up  audit,  NRCB  asserted  several 
reasons  for  its  decision  not  to  use  a risk-based 
compliance  program  for  surface  water: 

• Surface  water  issues  at  CFOs  are  readily 
visible  to  both  operators  and  the  public. 

• Surface  water  issues  are  more  likely  to  result 
from  open  feedlots  than  from  CFOs,  where 
animals  are  contained  in  barns  and/or  when 
liquid  manure  is  stored  in  lagoons  or  other 
structures. 

• NRCB  staff  have  a good  understanding  of 
the  surface  water  risks  associated  with  the 

50  largest  feedlots,  which  represent  60%  of  the 
feedlot  feeding  capacity  in  Alberta.  They  also 
asserted  that  they  randomly  selected,  from  a 
stratified  sample,  10  additional  operations  and 
concluded  that  they  had  familiarity  with  these 
sites. 

• Each  year,  NRCB  receives  about 

100  complaints  related  to  surface  water. 

• There  is  a strong  correlation  between 
complaints  involving  surface  water  during 
spring  runoff  and  during  periods  of  significant 
precipitation. 

• Mapping  of  potential  surface  water  risks 
is  unavailable  at  a scale  appropriate  to 
incorporate  into  a formal  compliance  program. 
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NRCB  also  indicated  it  plans  to: 

• test  and  verify  its  response  to  surface  water 
risk  issues  when  responding  to  complaints 

• use  precipitation  data  to  identify  areas  where 
unusually  high  amounts  of  precipitation  can 
lead  to  runoff  impacts  on  surface  water  quality, 
and  be  extra  vigilant  when  responding  to 
complaints  in  those  areas 

This  primarily  reactive  approach  means  NRCB  will 
take  action  only  after  surface  water  contamination 
has  occurred  While  management  anticipates  a 
sizeable  number  of  complaints,  NRCB  has  no 
way  to  measure  whether  the  public  is  identifying  a 
significant  portion  of  serious  surface  water  risks. 
Although  NRCB  plans  to  instruct  field  staff  to 
monitor  areas  that  receive  unusually  high  amounts 
of  precipitation,  it  has  not  defined  how  it  plans  to 
implement  this  initiative. 

NRCB's  recent  application  of  the  risk  screening 
tool  shows  that  surface  water  risks  may  exist  in 
some  CFOs.  As  mentioned  in  the  previous  section, 
NRCB  is  testing  the  validity  of  its  preliminary  risk 
screening  process  for  groundwater  with  a sample  of 
18  CFOs.  When  completing  these  assessments,  it 
also  completed  the  surface  water  section  of  the  risk 
screening  tool.  By  the  end  of  our  audit.  NRCB  had 
completed  13  of  these  assessments.  We  examined 
eight  of  these  assessments.  In  our  sample,  three 
out  of  eight  CFOs  had  structures  rated  medium  or 
high  for  surface  water  risk. 

In  addition,  in  response  to  our  2004 
recommendation  (October  2004  Report,  no.  28 — 
page  294),  NRCB  performed  one-time  proactive 
inspections  on  about  15%  of  all  CFOs.  During  our 
2007  follow-up  audit,  we  examined  a sample  of 
the  inspection  reports  for  30  CFOs.  Of  the  CFOs 
in  our  sample,  eight  CFOs  had  15  contraventions, 
as  identified  by  NRCB  inspectors.  Our  review  of  file 
details  shows  that  three  of  these  contraventions 
directly  impacted  surface  water  risk  and  another 
four  may  have  impacted  surface  water  risk. 

Although  NRCB  requires  operators  to  report 
all  changes  and  contraventions,  NRCB's 


compliance  files  show  that  not  all  such  changes  or 
contraventions  are  reported  As  a result,  the  CFO 
risk  level  may  change  without  NRCB  s knowledge 
particularly  if  the  operator  fails  to  follow  proper  site 
management  practices,  does  not  maintain  manure 
containment  structures  adequately  or  makes 
unapproved  modifications  or  new  construction  at 
the  CFO  facilities 

NRCB  management  does  not  plan  to  perform  a 
preliminary  assessment  of  all  CFOs  for  surface 
water  risk  NRCB  investigated  the  use  of  surface 
water  mapping  as  a tool  for  preliminary  assessment 
of  CFOs  for  such  surface  water  risk  factors  as 
proximity  to  water  bodies,  soil  type  terrain  and 
land  slope  NRCB  concluded  that  electronic 
based  surface  water  mapping  has  not  progressed 
sufficiently  to  allow  NRCB  to  effectively  identify 
potential  “at-risk"  common  bodies  of  water 

As  is  the  case  with  groundwater,  a preliminary 
assessment  for  surface  water  does  not  have  to 
include  all  risk  factors  For  example,  management 
asserted  to  us  that  surface  water  issues  are  more 
likely  to  occur  in  open  feedlots  From  its  files, 

NRCB  could  obtain  information  on  the  type  of 
operation  and  the  size  of  CFOs  The  proximity  of 
a CFO  to  surface  water  bodies  could  be  obtained 
using  publicly  available,  off-the-shelf  satellite  image 
software  While  this  method  does  not  show  slope 
or  natural  run-off  barriers  in  the  terrain,  it  could  be 
an  efficient  first  step  at  screening  out  CFOs  that  are 
obviously  low  risk,  and  focusing  on  those  that  could 
be  higher  risk 

Implications  and  risks  if  recommendation 
not  implemented 

If  NRCB's  processes  to  identify  and  mitigate 
surface  water  risks  are  not  working  properly, 
contamination  that  is  otherwise  preventable 
may  occur.  Once  surface  water  contamination 
occurs,  treatment  can  be  costly  and  of  uncertain 
effectiveness 
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Contract  for  a province-wide  forestry 
radio  system — implemented 

Background 

In  2002,  the  Department  of  Sustainable  Resource 
Development  (Department)  entered  into  a contract 
to  develop  a province-wide  radio  system.  The 
Department  had  to  renegotiate  the  contract  with  the 
contractor  because  of  financial  issues  experienced 
by  the  contractor.  Our  key  finding  was  that  the 
Department  did  not  adequately  consider  financial 
risks  when  entering  into  this  contract. 

In  our  October  2003  Report  (page  277),  we 
recommended  that  the  Department  follow 
the  government’s  best  practice  guidelines  for 
contracted  services  and  grants  when  undertaking 
major  capital  or  long-term  lease  projects. 

In  our  October  2007  Report  (vol.  2 — page  164), 
our  progress  report  indicated  that  although  the 
Department  had  created  a contract  user  manual, 
it  did  not  include  all  of  the  elements  covered  in  the 
government’s  best  practice  guidelines. 


Our  audit  findings 

The  Department  completed  its  revision  of  the 
Contract  User  Manual  (manual)  in  2009.  The 
manual  now  includes: 

• the  government’s  best  practice  guidelines  for 
contracted  services 

• guidance  as  to  when  staff  should  assess  the 
financial  stability  of  contractors 

The  Department  also  provided  us  with  additional 
questions  they  plan  to  require  staff  to  answer  about 
the  financial  stability  of  contractors,  as  part  of  the 
contract  approval  process 

In  addition,  the  Department  revised  its  contract 
business  case  form  to  improve  documentation  of 
its  analysis  of  the  alternatives,  operational  impacts, 
risks,  costs  and  benefits  associated  with  contracts. 
The  Department  does  not  often  have  contracts 


where  it  is  developing  a new  asset  by  having  a 
contractor  build  it  for  them  or  having  a contractor 
supply  the  asset  through  a lease  agreement  with 
the  Department.  Should  these  types  of  contracts 
arise,  we  will  continue  to  review  the  Department’s 
implementation  of  this  process  as  part  of  the 
financial  statement  audit. 

Project  management  for  contracts — 
implemented 

Background 

Beginning  in  October  2003  and  continuing  until 
March  2006,  the  Department  entered  into  a 
series  of  11  contracts,  totalling  $769,743,  with  the 
expectation  of  developing  a geographic  information 
management  strategy.  When  the  Department 
selected  the  contractor,  they  used  a sole  source 
selection  process — they  didn’t  ask  any  other 
consultants  to  bid  on  the  contract.  All  11  contracts 
were  awarded  to  the  same  consultant.  We  also 
found  that  other  contractors  were  not  considered 
for  any  part  of  the  development  once  it  was  under 
way.  Nor  could  we  find  written  evidence  that  the 
Department  evaluated  the  work  of  the  contractor 
at  the  project  milestone  dates.  On  four  of  the 
contracts,  the  original  amounts  were  increased 
through  amendments  totalling  $142,000. 

In  our  October  2007  Report  (page  165),  we 
recommended  that  the  Department  show  clearly, 
throughout  a project,  that  repeated  contracting 
with  the  same  contractor  is  a cost-effective  way  to 
achieve  that  project’s  desired  outcome. 


Our  audit  findings 


Key  Point 


The  Department's  processes  have  been  designed 
appropriately 

The  Department  revised  its  Contract  User  Manual 
and  the  forms  that  support  contracts. 

Both  the  manual  and  the  contract  coversheet  form 
now  require  staff  to  document  the  justification 
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for  sole-source  contractor  selection  and  reasons 
for  any  amendments  For  any  contract  where  a 
sole-source  selection  has  been  used,  the  contract 
business  case  form  must  be  signed  by  at  least  one 
level  of  staff  senior  to  the  staff  level  authorized  to 
sign  for  a completed  contract.  The  Department 
also  plans  to  periodically  have  the  Departments 
executive  review  repeat  vendors  that  have  been 
hired  for  non-emergency  purposes 

The  manual  now  sets  out  staff  requirements  for 
monitoring  and  administering  contracts  to  ensure 
that  work  is  proceeding  according  to  contract 
terms  and  that  progress  billings,  if  any.  relate 
to  the  work  performed  to  date.  The  Department 
has  also  implemented  a contract  evaluation  form 
that  requires  the  staff  managing  the  contract 
to  document  whether  the  contractor  met  all  of 
the  interim  benchmarks  and  all  of  the  contract 
deliverables. 

Reforestation — seed  inventory — 
implemented 

Background 

In  2006,  we  performed  an  audit  of  the  systems 
used  by  the  Department  to  monitor  and  enforce 
reforestation  standards.  Our  objective  was  to 
determine  whether  the  Department  had  adequate 
systems  in  place  to  ensure  reforestation  goals  and 
objectives  were  met. 

We  made  five  recommendations  to  the  Department 
in  our  October  2006  Report  (vol.  1 — pages  1 0S- 
132)  and  subsequently  followed  up  on  all  five  of 
these  recommendations  in  2008.  We  reported  our 
follow-up  findings  in  our  April  2009  Report  (pages 
49-61). 

In  respect  to  the  seed  inventory  recommendation 
(in  our  October  2006  Report,  vol.  1 — page  129),  we 
concluded  that  there  was  satisfactory  progress  as 
of  our  April  2009  Report.  However,  the  Department 
was  in  the  process  of  completing  the  following 
activities  to  fully  implement  the  recommendation 
• documenting  other  sources  of  seed  availability, 
for  seed  zones  where  management  identified  a 


shortage  of  seed  supply,  based  on  its  forecast 
or  operator  harvest  plans 
• completing  nursery  site  inspections  and 
concluding  which  additional  measures  are 
necessary  to  ensure  that  seed-zone  integrity 
is  maintained  between  the  Seed  Centre  and 
planting  in  the  seed  zone 

During  the  current  audit  we  followed  up  on  the 
above  two  activities  only 


Our  audit  findings 


Key  Point 


The  Department  has  completed  documentation 
of  seed  availability  and  its  seed  risk  management 
process  and  has  completed  the  nursery  on-site 
inspections 

The  Department  categorized  the  current  seed 
inventory  into  three  risk  categories  high,  medium 
and  low  For  the  high-risk  categories,  management 
requested  and  obtained  action  plans  from  the 
relevant  operators  These  operators  incorporated 
the  action  plans  into  their  annual  operating 
plans  The  forest  supervisors  and  head  office 
management  monitor  adherence  to  these  plans 
For  inventories  assessed  as  low  or  medium  risk, 
the  Department's  management  has  contacted  and 
will  continue  to  contact,  relevant  operators  to  find 
out  the  real  risk  level,  given  the  operators'  future 
harvesting  operations  The  Department  plans  to 
perform  this  analysis  and  report  on  the  results 
annually  For  any  seed  supply  that  may  shift  to 
the  high-risk  category,  the  Department  will  obtain 
remedial  action  plans  from  the  relevant  operators  to 
mitigate  this  risk 

The  Department  also  audited  all  15  nurseries  that 
currently  have  custody  of  the  seedlings  These 
nurseries  have  implemented  seedlot  tracking 
systems  to  ensure  they  control  the  seeds  from  the 
inventory  to  planting  in  the  seed  zone 
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Note  to  reader 

In  2009  and  2010.  we  reported  our  recommendations  to  the  Department  of  Advanced 
Education  and  Technology  and  Alberta's  post-secondary  institutions  under  three  broad 
themes  To  maintain  continuity  with  previous  reports,  we  report  our  findings  under  these 
themes,  on  the  following  pages 

• Improve  periodic  and  year-end  financial  reporting 67 

• Preserve  endowment  assets 69 

• Improve  internal  control  systems 70 

Our  current  findings  and  recommendations  for  specific  institutions  are  on  the  following 
pages 

• Department  of  Advanced  Education  and  Technology 67 

• Alberta  College  of  Art  and  Design  (ACAD) 69,  70 

• Grande  Prairie  Regional  College  69 

• Grant  MacEwan  University  68.  69.  75 

• Keyano  College 76 

• Lakeland  College 69.  79 
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Summary 


Department  of  Advanced 
Education  and  Technology 

In  our  April  2010  Report  (page  1 58),  we 
recommended  that  the  Department  of 
Advanced  Education  and  Technology  work  with 
post-secondary  institutions  to  develop  guidelines 
for  enterprise  risk  management.  We  also  made 
recommendations  to  several  institutions  to  improve 
their  risk  management  systems.  The  Department 
created  the  Campus  Alberta  Risk  and  Assurance 
Committee  to  oversee  the  development  of  guidance 
for  institutions  on  enterprise  risk  management. 
Some  institutions  have  also  made  progress  with 
implementing  our  recommendation  for  enterprise 
risk  management — see  page  67. 

Entities  that  report  to  the  Minister 

Once  again,  we  report  our  recommendations 
to  Alberta’s  colleges,  technical  institutes  and 
universities  under  themes  highlighted  in  our 
April  2009  Report,  page  75  and  April  2010  Report, 
page  151.  We  reported  to  each  institution’s 
management  on  internal  control  weaknesses 
identified  in  our  financial  statements  audits. 
Well-designed  and  effective  internal  controls  are 
critical  for  institutions  to  meet  goals,  safeguard 
assets  and  reduce  the  risk  of  fraud  and  error. 

We  have  not  yet  audited  the  financial  statements 
of  Northern  Lakes  College,  as  management  has 
experienced  significant  difficulty  in  completing  the 
financial  statements  and  providing  us  with  sufficient 
supporting  documentation.  We  will  include  the 
results  of  this  audit  in  our  October  2011  report. 

We  made  four  new  recommendations  to  Alberta 
College  of  Art  and  Design  (ACAD)  which  reflect  the 
challenges  it  continues  to  face  in  maintaining  sound 
and  sustainable  internal  control  systems.  These 
systems  are  important  in  helping  ACAD  conduct 
well-controlled  business  operations,  effectively 
and  efficiently  meet  goals,  safeguard  assets  and 
produce  reliable  financial  information. 


This  year,  we  make  10  new  recommendations  to 
individual  institutions,  and  repeat  four,  under  three 
themes  from  our  previous  reports: 

• improve  financial  reporting — provide  timely, 
relevant  and  accurate  financial  reports  to  senior 
management  and  board  audit  committees — see 
page  67 

• preserve  endowment  assets — define  goals  for 
using  and  preserving  the  economic  value  of 
endowments — see  page  69 

• improve  internal  control  systems — improve 
internal  controls  to  safeguard  assets  such 
as  cash,  limit  information  systems  access 
to  appropriate  staff,  clarify  and  segregate 
roles  and  responsibilities  of  staff,  review 
and  approve  transactions  to  ensure  they  are 
valid  and  reasonable,  and  reconcile  financial 
records  promptly  to  ensure  complete  revenue 
recognition  and  valid  financial  information — see 
page  70 

Improve  periodic  and  year-end  financial 
reporting 

Timely,  relevant  and  accurate  financial  information 
is  essential  to  running  any  institution.  Boards 
and  audit  committees  need  to  receive  regular 
summaries  of  that  information  to  effectively  oversee 
and  assess  management’s  overall  performance. 

We  recommend  that  Olds  College  improve  its 
processes  and  controls  over  year-end  financial 
reporting — see  page  68.  We  repeat  our 
April  2010  recommendation  to  Portage  College  to 
improve  financial  reporting  to  its  board  and  senior 
management  by  providing,  at  least  quarterly, 
complete  statements  of  financial  position  and  actual 
year-to-date  operating  results — see  page  68. 

Grant  MacEwan  University  has  implemented 
our  2010  recommendation  to  improve  financial 
reporting  to  its  board  and  senior  management. 
Lakeland  College  has  implemented  our 
recommendation  to  improve  its  processes  and 
controls  over  financial  reporting. 
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Medicine  Hat  College  s board  reviewed  its 
financial  information  and  concluded  they  are 
satisfied  with  the  level  of  reporting  We  note  that 
Medicine  Hat  College's  board  is  not  receiving  the 
level  of  interim  financial  reporting  that  boards  at 
other  post-secondary  institutions  receive  We  will 
continue  to  monitor  any  improvements  the  College 
makes  to  its  financial  reporting  See  page  68 

Preserve  endowment  assets 

In  Alberta,  public  colleges,  technical  institutes  and 
Grant  MacEwan  and  Mount  Royal  universities 
have  more  than  $100  million  of  endowment  funds. 
Earnings  from  these  funds  support  education, 
research  and  teaching.  While  some  donors 
encourage  spending  endowment  investment 
earnings,  others  expect  institutions  to  preserve 
the  real  value  of  endowments  over  time.  In  our 
April  2009  Report  (page  78),  we  recommended 
that  several  institutions  define  their  goals  for  using 
and  preserving  the  economic  value  of  endowment 
assets. 

Grande  Prairie  Regional  College,  Lethbridge 
College,  Medicine  Hat  College,  Mount  Royal 
University  and  Olds  College  have  implemented 
a similar  recommendation — see  page  69.  For 
those  institutions  that  have  not  yet  implemented 
our  recommendations  on  endowments,  we  will 
report  the  results  of  their  progress  to  implement 
the  recommendation  in  their  individual  sections 
in  future  reports,  instead  of  collectively  reporting 
under  the  theme  of  preserving  endowment  assets. 

Improve  internal  control  systems 

In  our  April  2010  Report  (page  151),  we  reported 
on  internal  controls  over  payroll,  payment  for  goods 
and  services,  revenue  collection,  bookstores, 
and  the  cost  of  hosting  guests  or  internal  working 
sessions,  sponsoring  events  and  making  donations. 
We  recommend  that  ACAD: 

• establish  policies  and  guidelines  for  its 
professional  development  fund — see 
page  71 

• develop,  implement  and  enforce  a code  of 
conduct,  conflict  of  interest  and  fraud  policies — 
see  page  72 


• improve  its  processes  for  the  set-up  and 
approval  of  fees  and  courses  delivered  under 
the  extended  studies  program — see  page  73 

• improve  its  controls  over  the  set-up 
maintenance  and  monitoring  of  its  vendor 
master  list — see  page  73 

In  our  April  2010  Report  (page  173),  we  reported 
that  Grant  MacEwan  University  had  taken  steps 
to  improve  its  control  environment  and  resolve 
its  information  technology,  processes  and  staff 
issues  In  our  October  2010  Report  (page  29).  we 
reported  that  the  University  still  needed  to  develop 
manual  processes  and  controls  for  the  remaining 
phases  before  implementing  its  enterprise  resource 
planning  system  The  University  has  updated  and 
implemented  new  policies  over  the  past  year  The 
University  is  also  implementing  the  enterprise 
resource  planning  system,  which  it  anticipates  will 
be  fully  operational  in  2010-2011  The  University 
must  still  ensure  it  implements  well-designed 
processes,  then  train  and  monitor  staff  to  make 
sure  they  follow  the  policies  and  processes 

Grant  MacEwan  University  has  implemented  our 
November  2006  recommendation  to  establish  a 
policy  clearly  indicating  it  will  not  solicit  or  accept 
donations  with  participating  vendors  during  a 
tendering  process — see  page  76 

Keyano  College  should 

• improve  access  control  policies  and  processes 
for  its  information  systems  to  ensure  that 

• user  access  to  the  College  s networks  and 
application  systems  is  disabled  when  an 
employee  leaves  their  employment 

• all  user  access  to  the  College's  computer 
networks  and  systems  is  properly 
authorized  and  all  staff  and  contractors, 
comply  with  the  College's  computer  use 
policy — see  page  77 

• develop  a policy  and  processes  for  monitoring 
and  investigating  breaches  of  security  to  its 
information  systems — see  page  78 

Lakeland  College  should  enhance  its  code  of 
conduct  processes  and  require  all  employees  to 
reconfirm  compliance  with  the  code  of  conduct 
regularly — see  page  79 
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We  also  repeat  our  April  2009  recommendation  to 
Lakeland  College  to: 

• adequately  segregate  access  to  the  PeopleSoft 
payroll  system — see  page  79 

• ensure  management  review  change  reports 
generated  from  the  payroll  system  for 
appropriateness — see  page  79 

Medicine  Hat  College  should  improve  its  controls 
over  cash,  accounts  receivable  and  accounts 
receivable  write-offs  related  to  tuition  by: 

• adequately  segregating  incompatible  functions 
of  preparing  daily  cash  receipts,  processing 
accounts  receivable  and  accounts  receivable 
write-offs 

• requiring  registration  clerks  to  use  cash  count 
sheets  for  controlling  cash  handling  and 
reconciling  cash  handovers  to  the  student 
accounts  clerk — see  page  80 

Northern  Alberta  Institute  of  Technology  has 
implemented  our  April  2010  recommendation 
related  to  purchasing  guidelines — see  page  81. 

We  repeat  our  April  2010  recommendation  to 
Olds  College  to  improve  internal  controls  in  the 
bookstore  to  sales  and  inventories.  See  page  81 . 

Portage  College  should  improve  the  accuracy  of  its 
perpetual  inventory  system  at  the  bookstore — see 
page  82. 

Red  Deer  College  has  implemented  our  April  2010 
recommendation  to  improve  its  controls  over 
payroll — see  page  83. 


Findings  and  recommendations 


Department  of  Advanced 
Education  and  Technology 
Improve  enterprise  risk  management 
systems — progress  report 
Background 

Effective  enterprise  risk  management  systems 
give  boards  and  senior  management  relevant  and 
timely  information  on  significant  strategic,  business, 
operational  and  financial  risks.  This  allows  boards, 
often  through  their  audit  committees,  to  effectively 


oversee  the  systems  that  management  uses  to 
assess  risks,  identify  changes  and  manage  them 
appropriately.  ISO  310001  is  an  internationally 
recognized  framework  of  principles  and  guidelines 
that  help  organizations  manage  risks. 

In  our  April  2010  Report  (page  158),  we 
recommended  that  the  Department  of 
Advanced  Education  and  Technology  work  with 
post-secondary  institutions  to  identify  good 
practices  and  guidelines  for  enterprise  risk 
management. 

Management’s  actions 

The  Department  and  post-secondary  institutions 
created  the  Campus  Alberta  Risk  and  Assurance 
Committee  to  oversee  guidance  for  enterprise  risk 
management.  The  Committee  has: 

• organized  a training  session  for  all  institutions 

• provided  training  on  ISO  31000  to  several 
institutions,  and  plans  more  training  for  2011 

• developed  an  agreement  that  institutions 
can  use  to  form  partnerships  with  other 
post-secondary  institutions  or  organizations  to 
assist  in  an  emergency 

The  University  of  Alberta,  Grant  MacEwan 
University,  Northern  Alberta  Institute  of  Technology 
and  NorQuest  College  have  signed  an  agreement 
to  share  facilities  and  equipment  if  a disaster 
occurs  at  any  of  their  institutions. 

Entities  that  report  to  the  Minister 
Improve  periodic  and  year-end 
financial  reporting 
Background 

In  our  April  2010  Report  (page  160),  we 
recommended  to  several  institutions  that  they 
provide  relevant  and  timely  financial  reporting  to 
senior  management  and  audit  committees.  Our 
recommendations  focused  on  providing  complete 
financial  statements  of  financial  position  and  actual 
year-to-date  operating  results,  at  least  quarterly. 
We  had  repeated  our  recommendation  to  Medicine 
Hat  College  from  our  April  2009  Report  (page  96). 


1 www.iso.org 
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We  also  recommended  in  our  April  2010  Report 
(page  162)  that  Lakeland  NorQuest.  Olds  and 
Portage  colleges  improve  to  varying  degrees  and 
for  various  reasons,  their  processes  and  controls 
for  efficient  and  accurate  financial  reporting 
We  repeated  a recommendation  from  our  April 
2008  Report  (page  180)  to  Alberta  College  of 
Art  and  Design  (ACAD)  to  improve  its  processes 
and  controls  for  efficient,  complete  and  accurate 
financial  reporting 


Recommendation:  improve  periodic 
financial  reporting 


RECOMMENDATION  REPEATED 


We  again  recommend  that  Portage  College 
improve  financial  reporting  to  its  board  and  senior 
management  by  providing — at  least  quarterly — 
complete  statements  of  financial  position  and 
actual  year-to-date  operating  results. 


RECOMMENDATION 


We  recommend  that  Olds  College  improve  its 
processes  and  controls  over  year-end  financial 
reporting. 


Criteria:  the  standards  for  our  audit 

Institutions  should  have  effective  systems  to 
produce  timely,  relevant  and  accurate  periodic 
and  year-end  financial  information  and  financial 
statements.  This  includes  clear  policies  and 
procedures,  knowledgeable  staff,  clear  roles 
and  responsibilities,  and  monitoring  and  review 
processes. 

Our  audit  findings 


Key  Points 


• Recommendation  repeated  for  Portage  College 

• Olds  College  had  difficulty  preparing  accurate  and 
timely  financial  statements 

• Grant  MacEwan  University  has  improved  its 
financial  reporting 

• Lakeland  College  has  improved  its  year-end 
processes 

• Medicine  Hat  College's  board  is  satisfied  with  level 
of  reporting  it  receives 

• ACAD  and  Portage  College  are  making  satisfactory 
progress  to  improve  year-end  processes 


Relevance  of  interim  financial  reports 
Portage  College — repeated 

We  repeat  our  recommendation  to  Portage  College 
because  it  did  not  improve  its  processes  to  produce 
quarterly  financial  reports  The  College  still  does 
not  provide  the  board  with  statements  of  financial 
position  and  changes  in  net  assets  as  part  of 
its  quarterly  financial  reports  In  addition  the 
statement  of  operations  still  does  not  include  actual 
year-to-date  results  or  comparative  information 
to  allow  committee  members  to  assess  results  of 
operations,  reasonability  of  annual  forecasts  and 
changes  from  last  year’s  results 

The  following  are  the  results  from  our  follow-up 
audits  of  financial  reporting  at  these  institutions 

Grant  MacEwan  University — implemented 

The  University  included  additional  information 
in  its  quarterly  financial  statements  to  senior 
management  and  the  board's  finance  and  audit 
committee,  as  well  as  explanations  for  significant 
variances  between  year-end  forecasts  and  annual 
budgets 

Medicine  Hat  College — implemented 

Since  receiving  the  recommendation  in  2009. 
College  management  improved  its  overall  financial 
reporting  process  by  presenting  to  the  board  a 
third-quarter  forecast  of  revenues  and  expenses 
to  June  30,  2010,  to  update  the  mid-year  review 
report  The  board  reporting  package  has  been 
enhanced  to  include  discussions  on  major 
variances,  trending  information  of  expenses  and 
revenues,  changes  to  capital  expenses,  and 
projected  unrestricted  and  restricted  net  assets 

Notwithstanding  these  improvements,  we  note  that 
the  College  s board  is  not  receiving  the  level  of 
interim  financial  reporting  that  a board-governed 
post-secondary  institution  typically  receives 
Management  stated  that  at  the  time  of  our  audit, 
given  the  current  resource  constraints  and 
information  systems  challenges,  they  did  not 
produce  complete  quarterly  financial  statements 
They  acknowledged  the  importance  of  good 
information  for  their  board  and  will  routinely 
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respond  to  requests  for  additional  information 
if  the  board  asks  for  it.  Management  plans  to 
continuously  improve  its  financial  reporting  process. 
However,  it  has  not  developed  long-term  plans 
to  improve  the  completeness  of  interim  financial 
reports  to  the  board.  The  board  assessed  our  audit 
recommendation  at  its  October  27,  2009  meeting 
and  concluded  that  it  is  satisfied  with  the  current 
level  of  reporting,  acknowledging  that  forecasts  are 
based  on  reasonable  estimates. 

Given  management's  limited  capability  in  the 
current  economic  environment  to  produce  complete 
interim  financial  reporting  using  existing  college 
resources  and  information  systems,  we  have 
deemed  the  recommendation  to  be  implemented. 
However,  in  future  audit  cycles,  we  will  continue 
to  follow  up  management’s  plans  to  improve  their 
financial  reporting  process,  and  look  at  accuracy  of 
their  forecasting  system. 

Systems  to  prepare  year-end  financial 

statements 

Olds  College 

Olds  College  had  not  completed  its  financial 
statements  and  working  papers  at  the  start  of 
our  audit  on  September  7,  2010.  Management's 
quality  control  and  review  processes  had  not 
identified  problems  with  the  financial  statements 
and  supporting  documentation  before  the  start  of 
the  audit.  We  brought  this  to  the  attention  of  the 
vice  president  of  student  and  support  services, 
and  withdrew  our  staff  from  the  audit.  We  were 
able  to  restart  our  work  on  October  12,  2010,  after 
the  College  was  able  to  complete  the  financial 
statements  and  working  papers. 

Following  are  the  results  from  our  follow-up  audits 
of  systems  for  preparing  financial  information  at 
these  institutions: 

Alberta  College  of  Art  and  Design — 
satisfactory  progress 

ACAD  made  significant  improvements  to  its 
financial  reporting  and  year-end  processes  for 
its  June  30,  2010  financial  statements.  We  found 
substantial  improvements  in  the  quality  of  ACAD’s 
working  papers  and  a notable  decline  in  working 
paper  errors  compared  to  2009.  Also,  the  draft 


financial  statements  required  fewer  revisions  when 
compared  to  the  previous  year.  ACAD’s  senior 
vice  president  of  finance  and  corporate  services 
also  reviewed  the  draft  financial  statements  before 
they  were  ready  for  audit.  Despite  improvements, 
some  issues  remain.  For  example,  we  noted  two 
instances  where  transactions  totalling  $450,000  for 
2010  were  incorrectly  recorded  in  2011. 

Lakeland  College — implemented 

Lakeland  College  has  improved  its  year-end 
procedures. 

Portage  College — satisfactory  progress 

Portage  College  is  improving  its  processes  and 
controls  over  financial  reporting,  with  the  goal 
of  increasing  efficiency  in  preparing  accurate 
internal  and  external  financial  reports.  We  saw 
improvement  in  the  completeness  of  the  working 
papers  management  provides  to  support  the 
numbers  in  the  year-end  financial  statements. 
Despite  these  improvements,  the  first  draft  of 
the  financial  statements  contained  several  errors 
and  we  did  not  receive  the  complete  financial 
statements  until  halfway  through  the  audit. 

Preserve  endowment  assets 

Background 

In  our  April  2009  Report  (page  78),  we 
recommended  that  Alberta  College  of  Art  and 
Design,  Grande  Prairie  Regional,  Keyano, 

Lakeland,  Lethbridge,  Medicine  Hat,  NorQuest, 
Olds,  Portage  and  Red  Deer  colleges  and  Mount 
Royal  University  define  their  goals  for  using  and 
preserving  the  economic  value  of  endowment 
assets.  In  our  April  2010  Report  (page  1 71 ),  we 
reported  that  Keyano,  Lakeland,  NorQuest,  Portage 
and  Red  Deer  colleges  had  implemented  our 
recommendation. 

In  our  April  2010  Report  (page  170),  we  also 
recommended  that: 

• Grant  MacEwan  University  improve  its 
endowment  and  related  investment  policies 
and  procedures  by: 

• establishing  and  reviewing  a spending 
policy  for  endowments 
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• improving  its  processes  to  review  its 
endowment  related  investments 

• improving  its  reporting  of  investments 
and  endowments  to  the  audit  and  finance 
committee 

• Southern  Alberta  Institute  of  Technology  (SAIT) 
clarify  its  expectations  for  preserving  the 
economic  value  of  its  endowment  assets  and 
document  an  endowment  policy  for  managing 
endowment  earnings 

Institutions  should  clarify  if  and  how  they  plan  to 
protect  the  value  of  endowments,  fund  current 
and  future  spending  from  investment  income,  and 
fund  expenses  in  years  when  there  are  investment 
losses.  They  should  also  have  systems  to  track 
investment  income  between  these  categories, 
and  record  investment  income  in  accordance  with 
accounting  principles. 


Criteria:  the  standards  for  our  audit 

Institutions  should  establish  goals  and  performance 
measures  for  preserving  endowments  and  should 
have  administrative  policies  and  processes  that 
help  meet  their  goals 


Our  audit  findings 


Key  Points 


• ACAD  and  Grant  MacEwan  University  are  still 
drafting  new  endowment  policies  and  procedures 

• Grande  Prairie  Regional,  Lethbridge,  Medicine  Hat 
and  Olds  colleges  and  Mount  Royal  University  have 
implemented  recommendations  for  preserving 
endowment  assets 

The  following  institutions  have  implemented  the 
recommendation: 

• Grande  Prairie  Regional  College  determined 
it  is  in  the  College's  best  interests  not  to 
inflation-proof  investments  unless  specifically 
requested  to  do  so  by  the  donor.  The  board 
approved  investment  policies  that  include 
discussing  the  intent  and  procedures  for 
preserving  the  economic  value  of  endowment 
investments. 


• Lethbridge  College  updated  its  investment 
policy  to  include  objectives  for  inflation-proofing 
endowments,  and  to  determine  the  annual 
spending  rates 

• Medicine  Hat  College  revised  its  donations 
and  fundraising  general  administration  policy 
to  outline  endowment  goals  and  provide  for 
inflation  protection  on  endowment  assets 
Management  also  tracks  whether  donors 
request  inflation-proofing  on  their  endowments 

• Mount  Royal  University  approved  a new 
endowment  management  policy  Management 
will  decide  annually  the  most  appropriate  use  of 
unspent  investment  returns,  based  on  a review 
of  factors  including  the  economic  environment 
The  University  will  use  the  Alberta  consumer 
price  index  as  a guiding  principle  rf  it  decides 

to  inflation-proof  the  endowments  over  the 
long  term. 

• Olds  College  updated  its  investment  policy 
to  include  objectives  for  inflation-proofing 
endowments,  and  to  determine  annual 
spending  rates. 

• SAIT  revised  its  endowment  policy  to  outline 
the  goals  and  objectives,  and  guidelines 

for  allocating  funds  SAIT  also  clarified  the 
investment  committee's  role  in  determining 
the  annual  funding  allocation,  and  the  required 
administrative  practices  that  should  be 
implemented 

ACAD  and  Grant  MacEwan  University  are  still 
drafting  new  investment  and  endowment  policies 
and  procedures 

Improve  internal  control  systems 
Alberta  College  of  Art  and  Design 
Alberta  College  of  Art  and  Design  (ACAD)  is  one 
of  Alberta's  smaller  post-secondary  institutions, 
with  about  1,200  students  Our  four  new 
recommendations  to  ACAD  reflect  the  challenges 
it  continues  to  face  in  maintaining  sound  and 
sustainable  internal  control  systems  These 
systems  are  important  in  helping  ACAD  conduct 
well-controlled  business  operations,  effectively 
and  efficiently  meet  goals,  safeguard  assets  and 
produce  reliable  financial  information 
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Policy  for  managing  professional 
development  funds 

Background 

ACAD  operates  a professional  development 
fund  with  an  annual  budget  of  $250,000  to  be 
used  for  college-wide  professional  development, 
such  as  attending  courses.  In  2010,  ACAD  spent 
approximately  $108,000  from  this  fund — $47,000 
for  46  faculty  staff,  $51 ,000  for  five  executive 
employees  and  $10,000  for  administrative  staff. 


Recommendation:  professional 
development  fund 


RECOMMENDATION 


We  recommend  that  Alberta  College  of  Art  and 
Design  establish  policies  and  guidelines  for  the 
management  of  its  professional  development 
fund. 


Criteria:  the  standards  for  our  audit 

ACAD  should  establish  policies  that  clearly 
communicate  the: 

• objectives  and  purpose  of  the  professional 
development  fund 

• nature  and  type  of  professional  development 
initiatives  to  be  funded,  including  the  benefits 
and  relevance  to  the  College 

• qualifying  and  eligibility  criteria  for  funding 

Management  should  also  provide  guidance  such  as 
standards  and  practices  that  apply  to  all  employees 
who  wish  to  access  the  professional  development 
fund. 


Our  audit  findings 


Key  Points 


• No  policies  or  administrative  practices  on  the 
fund's  purpose,  application  and  approval  criteria 
and  processes 

• Inconsistent  payment  processes  for  executive  and 
other  staff 

ACAD  does  not  have  clear  policies,  guidelines  and 
practices  that  prescribe  the: 

• purpose  of  the  fund 


• nature  and  type  of  professional  development 
initiatives  to  be  funded  under  the  program, 
including  relevance  and  benefits  to  the  College 

• criteria  for  qualifying  for  funding,  as  well  as  the 
procedures  for  applying  and  accessing  funding 
from  this  fund 

At  the  board  of  governors  meeting  on 
May  26,  2010,  the  president  acknowledged  that 
not  all  staff  had  access  to  this  fund.  He  also 
indicated  that  management  would  develop  a 
terms  of  reference  to  allow  staff  to  understand  the 
fund’s  use,  along  with  how  to  apply  for  the  funds. 
However,  at  the  conclusion  of  our  audit  fieldwork, 
ACAD  had  not  established  the  anticipated  terms  of 
reference. 

In  2010,  executive  staff  incurred  approximately 
$49,000  for  international  courses  and  seminars. 

We  found  no  criteria,  guidelines  or  documentation 
to  show  the  process  ACAD  followed  for  approving 
requests  by  certain  staff  to  attend  international 
courses. 

In  addition,  ACAD  applied  inconsistent  practices  for 
accessing,  applying  for  and  paying  for  professional 
development  funds.  For  example,  faculty  staff  paid 
for  their  courses  and  claimed  a reimbursement 
upon  completion  or  conclusion  of  the  course  or 
event.  However,  for  executive  staff,  ACAD  paid  the 
expenses,  including  related  travel  advances,  in 
advance  of  the  course  or  seminar. 


Implications  and  risks  if  recommendation 
not  implemented 

In  the  absence  of  clear  policies  and  procedures, 
ACAD  might  not  manage  its  professional 
development  funds  in  an  efficient,  effective  and 
equitable  manner. 

Code  of  conduct  policy  and  conflict  of 
interest  policies 

Background 

In  2009,  ACAD’s  board  of  governors  approved 
and  adopted  22  policies  for  college-wide  use. 
Included  in  these  policies  was  a code  of  conduct 
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and  a conflict  of  interest  policy  that  applied  to  board 
members. 

In  August  2010,  ACAD  hired  a consultant  to  review 
and  update  its  policies  and  procedures  to  reflect 
best  practices,  to  draft  new  policies  and  procedures 
where  necessary,  and  to  ensure  its  procedures  are 
aligned  to  policies  the  board  approved  in  2009  The 
work  was  scheduled  to  be  completed  in  two  stages, 
the  first  set  for  completion  by  December  2010,  and 
the  remainder  by  December  2011 


Recommendation:  code  of  conduct, 
conflict  of  interest  and  fraud  policies 


RECOMMENDATION 


We  recommend  that  Alberta  College  of  Art  and 

Design: 

• develop,  implement  and  enforce  policies  for 
code  of  conduct  and  conflict  of  interest 

• develop  and  implement  a fraud  policy  that 
clearly  defines  actions,  responsibilities, 
authority  levels  and  reporting  lines  in  case  of 
fraud  allegations 


Criteria:  the  standards  for  our  audit 

ACAD  should  define,  communicate  and  enforce 
codes  for  acceptable  business  practices,  to  ensure 
a sound  control  environment.  Specifically,  ACAD 
should: 

• have  an  enforceable  code  of  conduct  for  all 
employees 

• enforce  compliance  with  policies  and 
procedures 

• have  a policy  for  responding  to  fraudulent  or 
suspected  fraudulent  behaviour  or  irregularities 
involving  employees  or  other  parties  with  a 
business  relationship  with  ACAD 

Our  audit  findings 


Key  Points 


• Code  of  conduct  for  board  members  but  not  for 
employees 

• No  policy  for  dealing  with  suspected  fraud  and 
irregularities 


While  we  acknowledge  the  actions  taken  by 
management,  we  also  found  the  following 

Code  of  conduct  and  conflict  of  interest  policy 

ACAD's  code  of  conduct  does  not  apply  to  its 
employees  The  code  of  conduct  for  the  board 
of  governors  does  not  require  annual  sign-off  by 
board  members  as  an  acknowledgement  of  their 
compliance  with  its  terms 

ACAD's  conflict  of  interest  policy  requires  board 
members  to  annually  confirm  their  compliance 
with  the  policy,  in  writing  We  found  no  evidence  of 
board  members  having  confirmed  their  compliance 
with  the  policy. 

Fraud  policy  and  a process  to  investigate 
complaints 

ACAD  does  not  have  a formal  fraud  policy  Nor 
was  a fraud  policy  included  in  policies  proposed 
for  development  by  the  consultant  A fraud  policy 
would  prescribe  how  to  deal  with  alleged  fraud, 
including  assigning  responsibility  for  investigating 
suspected  fraud  or  irregularities  within  ACAD  and 
reporting  these  to  the  finance  and  audit  committee 
Although  no  fraud  was  noted  in  2010,  ACAD 
previously  had  an  incident  of  fraud 

ACAD  lacks  policies  and  guidelines  for  investigating 
and  resolving  complaints  As  a consequence, 

ACAD  does  not  have  a formal  mechanism  for 
investigating  complaints  of  suspected  fraud 
or  irregularities  involving  employees,  vendors, 
contractors  or  other  parties  that  have  a business 
relationship  with  ACAD.  ACAD  should  consider 
these  issues  when  developing  the  safe  disclosure 
or  whistle  blower  policy  it  requested  its  consultant 
to  prepare  Also,  the  fraud  policy  should  be  aligned 
to  the  board's  code  of  conduct,  conflict  of  interest 
and  safe  disclosure  policies,  as  well  as  the  detailed 
procedures  that  are  currently  being  developed 


Implications  and  risks  if  recommendation 
not  implemented 

In  the  absence  of  well-developed  policies  and 
procedures,  ACAD's  operations  may  not  be 
conducted  in  an  efficient  and  effective  manner 
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Without  a fraud  policy,  ACAD  may  not  have  a 
consistent  approach  to  recording,  investigating 
and  referring  suspected  fraud  and  abuse  to  the 
authorities. 

Extended  studies  program — setup  and 
approval  of  fees  and  courses 

Background 

ACAD’s  extended  studies  unit  offers  non-credit 
courses.  In  2010,  the  extended  studies  program 
generated  $900,000  in  course  fees,  representing  a 
5%  increase  from  the  $854,000  earned  in  2009. 


Recommendation:  controls  over  extended 
studies  program 


RECOMMENDATION 


We  recommend  that  Alberta  College  of  Art  and 
Design  improve  its  processes  for  the  set-up  and 
approval  of  fees  and  courses  delivered  under  the 
extended  studies  program. 

Criteria:  the  standards  for  our  audit 

ACAD  should  have  effective  controls  over  the 
set-up  and  approval  of  fees  and  courses  in  its 
extended  studies  program.  This  includes  the  proper 
segregation  of  activities  and  an  independent  review 
of  changes  in  fees  and  courses. 


Our  audit  findings 


Key  Point 


No  independent  review  of  processes  over  extended 
studies  program 

ACAD  does  not  have  an  effective  control  to  review 
the  set-up  and  approval  of  fees  and  courses  in  its 
extended  studies  program.  There  is  also  improper 
segregation  of  functions;  the  director  of  extended 
studies  proposes,  sets  up  and  approves  all  courses 
for  inclusion  in  this  program.  The  director  also 
establishes  the  course  fees  and  has  the  sole 
authority  for  proposing  and  approving  revisions 
to  courses  and  fees.  Although  the  director  had 
the  authority  to  set  fees,  we  saw  no  independent 
review  of  the  changes  to  the  courses  and  fees  that 
the  director  processed. 


Implications  and  risks  if  recommendation 
not  implemented 

Without  adequate  separation  of  functions  and 
independent  review  of  changes  to  the  extended 
studies  program  fees  and  courses,  ACAD  may  not 
earn  the  appropriate  level  of  fees,  and  the  risk  of 
fraud  increases. 

Vendor  records 

Background 

ACAD  uses  a customized  computer  application  as 
a point  of  sales  system  to  process  and  generate 
purchase  orders,  as  well  as  to  record  and  maintain 
vendor  information  in  a master  list.  The  majority  of 
ACAD’s  vendor  activities  relate  to  its  bookstore. 

Common  controls  in  a good  control  environment 
include  having  designated  an  appropriate  level 
of  employee  who  reviews,  approves  and  makes 
changes  to  vendor  records.  This  will  mitigate  the 
risk  of  fraud  or  unauthorized  changes  to  the  vendor 
records. 


Recommendation:  controls  over  vendor 
master  file  set-up  and  maintenance 


RECOMMENDATION 


We  recommend  that  Alberta  College  of  Art  and 
Design  improve  its  controls  over  the  set-up, 
maintenance  and  monitoring  of  its  vendor  master 
list. 


Criteria:  the  standards  for  our  audit 

ACAD  should  have  effective  controls  over  vendor 
records,  including  segregating  incompatible  job 
duties  to  set  up,  approve,  maintain  and  monitor  the 
vendor  master  listings. 


Our  audit  findings 


Key  Point 


Incompatible  duties  not  properly  segregated  or 
subject  to  appropriate  independent  review 

The  responsibilities  for  day-to-day  maintenance, 
updating,  monitoring  and  reviewing  of  the  vendor 
master  list  are  not  properly  segregated  and  are 
not  subject  to  proper  approvals.  For  example, 
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the  bookstore  supervisor  has  the  ability  to  initiate 
and  approve  changes  to  the  list  without  a second 
level  of  review  or  approval  As  well,  there  is  no 
requirement  for  a regular  review  of  the  vendor 
master  list  by  a person  who  is  independent  from 
the  one  who  maintains  the  vendor  master  list 

Management  stated  that  changes  to  the  vendor 
master  list  are  controlled  through  the  review 
and  approval  of  purchase  orders  by  the  director 
of  ancillary  services.  This  review  ensures  that 
purchases  and.  therefore,  any  additions  to  the 
vendor  master  list  are  appropriately  approved. 
However,  approval  of  purchase  orders  does  not 
consistently  occur  before  goods  are  delivered 
We  noted  instances  where  purchase  orders  or 
requisitions  were  issued  only  after  goods  had  been 
received  or  upon  receipt  of  suppliers’  invoices. 


Implications  and  risks  if  recommendation 
not  implemented 

Without  strong  controls  over  the  maintenance  of 
vendor  records  and  the  vendor  master  list,  there  is 
an  increased  risk  that  inappropriate  transactions 
might  occur  and  go  undetected. 

Bookstore  operations — satisfactory 
progress 

Background 

In  our  April  2010  Report  (page  181),  we 
recommended  that  ACAD  maintain  an  effective 
system  of  internal  controls  to  enhance  the  integrity 
of  its  bookstore  operations.  We  highlighted  the 
following  internal  control  deficiencies: 

• inadequate  inventory  management  and  control 
system,  absence  of  controls  and  procedures 
to  periodically  reconcile  inventory  records 

to  actual  inventory  and  to  approve  inventory 
write-offs 

• absence  of  policies  and  procedures  for  pricing 
and  marking  up  goods,  processing  refunds  and 
write-offs,  and  lack  of  proper  segregation  of 
duties 

• poor  system  access  controls:  for  example, 
use  of  same  log  on  password  and  username 
by  bookstore  operators,  absence  of  access 


privileges  based  on  work  to  be  performed 
by  staff,  and  absence  of  controls  to  prevent 
unauthorized  access  to  the  bookstore  safe  and 
attractive  assets 

Our  audit  findings 


Key  Points 


• Improvements  made  to  inventory  management 
and  control  systems,  and  pricing  policies 

• Access  controls  still  need  improvements 

ACAD  has  acted  on  two  of  the  three  deficiencies 
we  identified  It  is  working  with  the  system 
vendor  to  build  adequate  access  controls  into  the 
bookstore  system  As  a result,  we  concluded  ACAD 
has  made  satisfactory  progress  with  implementing 
our  recommendation  We  noted  the  following 
control  improvements: 

• The  bookstore  access  database  produces  a 
variance  report  that  management  compares 
to  the  bookstore’s  actual  year-end  inventory 
count.  The  director  of  facility  and  ancillary 
services  reviews  and  authorizes  variances 
before  passing  the  information  to  the  director  of 
finance  for  approval  and  recording 

• In  July  2010,  ACAD  adopted  a pricing  policy 
that  has  guidelines  for  setting  up  prices  and 
markups  for  bookstore  merchandise  Further, 
the  bookstore  supervisor  now  approves  all 
returns  processed  by  the  cashier 

• In  July  2010,  ACAD  updated  the  bookstore  s 
procedures  for  processing  transactions  In 
addition  to  a password,  the  cashiers  and 
bookstore  operators  are  now  assigned  a 
unique  code  for  processing  any  transaction  in 
the  bookstore  system  This  control  helps  track 
transactions  to  the  person  who  initiates  them 

Despite  these  improvements,  the  access  controls 
are  not  operating  effectively  All  bookstore 
operators  use  the  same  username  and  password  to 
log  onto  the  bookstore  database,  and  there  are 
no  access  restrictions  depending  on  the  functions 
that  operators  should  perform  Consequently,  any 
operator  could  view  and  extract  the  code  assigned 
to  other  bookstore  operators  and  could  potentially 
use  the  code  to  process  a transaction  through  the 
system 
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To  fully  implement  this  recommendation,  ACAD 
must: 

• assign  usernames,  passwords  and  codes 
that  are  unique  to  each  bookstore  operator, 
to  strengthen  system  access  rights  and 
restrictions 

• institute  system  access  privileges  that  limit 
operators’  access  to  components  of  the 
database  that  are  relevant  to  their  assigned 
responsibilities,  to  effectively  segregate 
functions 


Implications  and  risks  if  recommendation 
not  implemented 

The  absence  of  an  effective  system  of  internal 
controls  impairs  the  integrity  of  transactions 
processed  in  the  bookstore  system  and  exposes 
ACAD  to  a risk  of  loss  of  assets  through  theft  and 
misappropriation. 

Grant  MacEwan  University 

In  our  April  2010  Report  (page  173),  we  reported 
that  the  University  had  started  several  initiatives 
and  taken  preliminary  steps  to  improve  its  control 
environment  and  resolve  its  information  technology, 
processes  and  staff  issues.  The  University  has 
updated  and  implemented  new  policies  over  the 
past  year.  It  is  also  implementing  a new  enterprise 
resource  planning  system  that  the  University 
anticipates  will  be  fully  operational  in  2010-2011. 

In  our  October  2010  Report  (page  29),  we  reported 
that  while  the  University  would  rely  on  many 
processes  and  controls  within  its  new  enterprise 
resource  planning  system,  it  still  needed  to  develop 
manual  processes  and  controls  for  the  remaining 
phases  before  implementing  the  system. 

We  will  review  if  the  University  has  implemented 
well-designed  processes  and  controls  and  we 
will  test  their  operating  effectiveness  once  the 
University  has  completed  these  initiatives. 

Signed  contracts  in  place — 
recommendation  repeated 

We  repeat  this  recommendation  because  the 
results  of  our  testing  this  year  indicate  that  progress 
has  been  unsatisfactory. 


Background 

In  our  November  2006  Report  (no.  9 — page  35),  we 
recommended  Grant  MacEwan  University 
ensure  that  signed  contracts  (interim  or  final)  for 
construction  projects  are  in  place  before  projects 
start.  The  University  had  paid  approximately 
$18.1  million  over  10  months  with  no  signed  interim 
or  final  contract  in  place. 

The  University’s  procurement  policy  states  that 
goods  and  services  should  be  procured  by 
authorized  employees  through  an  effectively 
managed,  properly  planned  and  executed  process. 
The  purpose  of  this  policy  is  to  ensure  procurement 
decisions  and  activities  make  the  best  use  of 
resources  for  an  intended  purpose,  demonstrate 
the  values  and  mission  of  the  University,  and 
are  ethical,  fair,  transparent  and  consistent  with 
legislation. 


Recommendation:  ensure  contracts  are 
signed  before  work  begins 


RECOMMENDATION  NO.  3— REPEATED 


We  again  recommend  that  Grant  MacEwan 
University  have  signed  contracts  (interim  or  final) 
in  place  before  projects  start. 

Criteria:  the  standards  for  our  audit 

The  University  should  ensure: 

• appropriate  approval  is  in  place  before  entering 
into  a contract 

• legally  enforceable  contracts  with  its 
contractors  are  in  place  that  define  the  roles 
and  responsibilities  of  both  parties  before  a 
contractor  supplies  goods  or  services 

• contract  payments  are  in  accordance  with  the 
terms  of  the  contract 


Our  audit  findings 


Key  Point 


Contracts  or  other  documents  setting  out  terms  and 
conditions  not  signed  before  services  start 
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We  selected  10  contracts  for  testing  We 
identified  the  following  cases  where  the  University 
was  operating  without  a signed  contract: 

• The  University  entered  into  a three-year 
contract  with  a facility  services  company  for 
approximately  $2.25  million  Services  under 
this  contract  began  on  October  27,  2009 
The  University  signed  this  contract  on 

May  18,  2010. 

• The  University  entered  into  a five-year  contract 
with  a company  for  approximately  $3.8  million. 
Services  under  this  contract  began  on 
December  31, 2009;  however,  the  company  did 
not  sign  the  contract  until  September  1,  2010. 
We  were  told  that  the  University  contacted 

the  company  regarding  the  unsigned  contract; 
however,  we  did  not  see  any  documentation  to 
support  this  assertion. 

• The  University  received  services  under  a 
contract  with  an  engineering  company  that 
was  signed  on  August  7,  2009.  However,  work 
under  this  contract  and  billing  for  services 
began  in  June  2009. 

We  did  not  see  any  documentation  indicating  how 
the  University  was  mitigating  the  risk  of  not  having 
a signed  contract.  It  was  also  unclear  whether  the 
University’s  processes  allow  for  enough  time  to 
renew  contracts  before  they  expire. 


Implications  and  risks  if  recommendation 
not  implemented 

Without  a signed  contract  in  place,  roles  and 
responsibilities  of  the  parties  may  not  be  clear  or 
enforceable. 

Soliciting  donations — implemented 

Background 

In  our  November  2006  Report  {no.  10 — page  137), 
we  recommended  that  Grant  MacEwan  University 
establish  a policy  clearly  indicating  it  will  not  solicit 
or  accept  donations  with  participating  vendors 
during  a tendering  process. 


Our  audit  findings 


Key  Point 


New  fundraising  policy  implemented 

In  April  2010,  the  board  approved  a new  fundraising 
policy  This  policy  states  that  the  University  does 
not  allow  gifts,  gifts-in-kind  or  sponsorships  to  be 
used  to  leverage  unfair  advantages  or  court  favours 
in  University  operations,  including  contracts, 
employment,  admissions  or  any  academic  issue  It 
also  states  that  University  employees  engaged  in 
donor  liaison  and  soliciting  gifts  must  not  grant  or 
accept  favours  for  personal  gain  and  must  avoid 
actual  or  perceived  conflicts  of  interest 

In  addition,  the  board  approved  a new  procurement 
policy  in  February  2010  This  policy  states  that  all 
procurement  decisions,  actions  or  communications 
must  avoid  real  or  perceived  conflicts  of  interest, 
including  solicitation  or  acceptance  of  donations 
with  participating  vendors  during  a bidding  process 

The  University  has  worked  on  ensuring  a high 
level  of  staff  awareness  about  accepting  donations 
through  the  fundraising  process  and  avoiding 
possible  conflicts  with  contracts  being  awarded 

Keyano  College 

User  access  controls 

Background 

System  access  controls  are  a cornerstone  of  data 
security.  They  ensure  that  users  cannot  make 
unauthorized  changes  to  systems,  applications  or 
the  data  in  them. 

When  an  employee  leaves  employment  at  Keyano 
College,  their  supervisor  is  required  to  complete 
a Staff  Out  Clearance  form  and  submit  it  to  the 
payroll  department.  The  payroll  department  is 
then  to  notify  the  information  technology  services 
department  to  disable  the  employee's  access  ID 
and  password  This  would  ensure  that  a former 
employee's  privileged  access  to  networks  and 
applications  is  no  longer  available 
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The  College  has  three  key  business  and  financial 
application  systems  that  we  reviewed  for  this  audit: 

• Great  Plains — financial  system 

• CLASS — sport  and  wellness  centre 

• Power  Campus — student  registration 


Recommendation:  access  controls  to  key 
financial  systems 


RECOMMENDATION 


We  recommend  that  Keyano  College  improve 
access  control  policies  and  processes  for  its 
information  systems  to  ensure  that: 

• user  access  to  networks  and  application 
systems  is  disabled  when  employees  leave 
their  employment 

• user  access  to  computer  networks  and 
systems  is  properly  authorized  and  all  staff 
and  contractors  comply  with  the  computer 
use  policy 

Criteria:  the  standards  for  our  audit 

Keyano  College  should: 

• have  a clear  policy  and  documented  control 
process  for  managers  to  follow  in  requesting, 
approving,  granting,  regularly  reviewing  and 
terminating  access  to  financial  systems  and 
supporting  computer  infrastructure 

• ensure  that  access  control  processes  gather 
appropriate  evidence  to  show  they  are 
regularly  followed  and  that  staff  comply  with  the 
computer  use  policy — specifically,  not  sharing 
user  accounts  (IDs  and  passwords) 


Our  audit  findings 


Key  Points 


• Processes  need  improvement  to  remove  users' 
access  after  they  leave 

• Networks  accessed  using  user  accounts  of  former 
staff 

• User  accounts  shared  between  staff  and 
contractors 

We  examined  processes  for  approving,  granting 
and  terminating  user  access  privileges  to  their 
information  systems.  We  found  that: 

• when  a staff  member  leaves  employment,  the 
information  technology  branch  does  not  always 


receive  a Staff  Out  Clearance  form  to  disable 
the  employee’s  network  and  application  access 
• user  accounts  (IDs  and  passwords)  belonging 
to  former  employees  were  shared  with 
temporary  and  contract  staff,  which  is  a breach 
of  the  computer  use  policy 

User  accounts  belonging  to  former  employees 
not  always  disabled — We  tested  the  processes 
to  disable  users’  access  to  the  network  and 
three  key  business  applications.  We  found  that 
accounts  for  19  out  of  63  former  staff  were  still 
active  as  of  May  1 0,  2010.  Of  these  1 9 accounts, 
eight  had  been  used  to  access  the  network  and 
three  key  business  applications,  with  the  earliest 
occurrence  dating  back  to  July  2009.  We  informed 
management  of  this.  We  also  found  the  College 
needed  to  improve  its  investigation  and  monitoring 
processes.  See  Information  technology  security 
event  monitoring  investigation  (page  below). 

User  accounts  were  shared  with  temporary 
and  contract  staff — Staff  do  not  comply  with  the 
computer  use  policy.  The  College  reported  to  us 
that  the  eight  user  IDs  that  belonged  to  former 
employees  were  not  disabled  in  accordance  with 
their  policy.  Rather,  the  user  IDs  were  assigned 
to  temporary  staff  and  contractors.  There  was  no 
formal  documentation  prepared  to  reassign  the 
accounts  to  the  contractors. 


Implications  and  risks  if  recommendation 
not  implemented 

Ineffective  controls  over  access  to  the  College’s 
network  and  key  business  applications  may  result 
in  unnecessary  risk  for  system  failure,  unauthorized 
access,  security  exposure  and  fraud. 

Information  technology  security  event 
monitoring  and  investigation 

Background 

Most  information  security  devices  and  business 
applications  have  security  features  that  can  log  and 
report  all  levels  of  events  and  activities.  Information 
about  potential  threats  and  vulnerabilities,  as  well 
as  user  access  information  such  as  user  identifier, 
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time  and  type  of  access,  can  all  be  logged  to 
detect  security  threats.  Continuous  monitoring 
of  such  logs  allows  management  to  take  timely 
action  to  investigate  the  security  event,  assess  its 
impact  and  take  appropriate  action  to  prevent  a 
recurrence  System  log  management  tools  can  be 
used  to  generate  alerts  and  reports  automatically. 


Recommendation:  monitor  access  to  key 
financial  systems 


RECOMMENDATION 


We  recommend  that  Keyano  College  develop 
a policy  and  processes  for  monitoring  and 
investigating  breaches  of  security  to  its 
information  systems. 

Criteria:  the  standards  for  our  audit 

The  College  should: 

• have  control  processes  in  place  to  log  and 
monitor  information  security  and  access 
violations — Such  processes  should  also  state 
how  security  violations  should  be  reported  and 
remediated. 

• have  policies  and  procedures  to  conduct  a 
security  investigation  when  a breach  of  its 
security  controls  or  devices  has  occurred  or 
is  suspected — This  should  include  reporting 
the  event  to  senior  management  and 
recommending  proactive  measures  to  prevent 
a recurrence  of  the  security  event. 

• properly  configure  and  keep  current  access 
controls  lists  (e  g.,  network  active  directory)  for 
network  operating  systems,  applications  and 
other  security  devices  to  prevent  unauthorized 
access 


Our  audit  findings 


Key  Point 


Access  to  financial  systems  not  monitored  for 
unauthorized  access 

The  College  does  not  have  a formal  security  policy 
and  processes  to  guide  it  through  an  information 
technology  (IT)  security  investigation.  IT  staff 
review  security  logs  and  alerts  reactively,  and 
without  predefined  controls  to  assess  the  level 
of  risk  or  impact  of  threats.  The  College  has 
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software  to  monitor  and  identify  security  events 
in  its  computing  environment  However.  IT  staff 
use  the  software  mainly  for  network  infrastructure 
performance  and  troubleshooting  rather  than 
security  monitoring 

We  identified  that  the  user  accounts  of  eight  out 
of  19  former  employees  were  used  to  access 
the  College's  networks  and  key  business 
applications  (see  page  77)  The  College  was 
unaware  of  these  incidents  until  we  advised  them 
Management  disabled  the  19  system  accounts 
within  24  hours  of  being  notified  of  this  activity 

The  College  conducted  an  informal  investigation 
We  were  advised  that  the  eight  accounts,  originally 
assigned  to  the  former  employees,  had  user  IDs 
and  passwords  that  were  shared  with  temporary 
and  contract  staff  The  College  also  reported  to  us 
that  it  believed  there  was  no  significant  or  material 
exposure  from  this  incident  because  the  affected 
accounts  had  limited  system  access  privileges 
However,  it  was  difficult  for  the  College  to  trace  the 
activities  of  the  users  who  accessed  the  network 
and  the  application  systems  Security  event  logging 
for  system  components  have  limited  capability,  and 
tools  available  for  network  monitoring  are  not  fully 
used  As  a result,  the  College  could  not  assess 
whether  there  was  any  wrongdoing  from  the  use  of 
these  accounts. 

We  concluded  that  the  College  is  unable  to 
demonstrate  that  it  has  the  capability  to  prevent 
or  promptly  detect  future  security  breaches  with 
unauthorized  user  access,  because  of  the  weak 
user  access  controls,  weak  system  security  event 
monitoring  detection  and  the  lack  of  a formal  IT 
security  investigation  process 

Implications  and  risks  if  recommendation 
not  implemented 

Management  will  not  know  when  or  to  what  extent 
its  networks  and  applications  have  had  an  IT 
security  exposure  that  could  affect  the  integrity  of 
the  College's  information,  operations  and  public 
reputation. 
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Lakeland  College 

Code  of  conduct 

Background 

A code  of  conduct  is  an  essential  part  of  an 
organization's  control  over  its  operations.  For 
this  control  to  be  effective,  employees  must 
acknowledge  that  they  understand  the  code  of 
conduct’s  requirements,  agree  to  abide  by  them 
and  accept  that  if  they  violate  policy  there  will 
be  consequences.  The  code  of  conduct  and  the 
consequences  of  violating  it  should  be  clear. 

The  College  approved  and  implemented  a revised 
code  of  conduct  in  2009.  The  policy  requires  new 
employees  to  read,  understand  and  agree  to 
abide  by  the  policy.  Employees  are  then  required 
to  sign  and  send  the  code  of  conduct  agreement 
to  the  human  resources  office  at  the  start  of  their 
employment.  In  addition,  all  staff  must  review  the 
code  of  conduct  during  their  annual  employee 
performance  appraisal  and  reconfirm  their 
compliance  and  understanding  of  the  policy. 


Recommendation:  improve  controls  for 
staff  to  formally  acknowledge  code  of 
conduct 


RECOMMENDATION 


We  recommend  that  Lakeland  College  enhance 
its  code  of  conduct  processes  and  require  all 
employees  to  reconfirm  compliance  with  the  code 
of  conduct  regularly. 

Our  audit  findings 


Key  Point 


Employee  acknowledgement  process  not  fully 
complied  with 

As  a result  of  our  testing,  we  found  that: 

• eight  out  of  10  newly  hired  employees  did  not 
have  a code  of  conduct  acknowledgement  form 
on  file 

• human  resources  staff  could  not 
provide  evidence  of  employees’  annual 
acknowledgement  of  the  code  of  conduct  for 
eight  out  of  15  current  employees 


We  also  observed  that  the  code  of  conduct 
acknowledgement  form  does  not  describe 
corrective  actions.  The  form  does  not  include  a 
requirement  that  employees  agree  to  adhere  to  this 
policy  or  to  say  that  they  understand  that  in  case  of 
violation  they  would  face  disciplinary  action. 


Implications  and  risks  if  recommendation 
not  implemented 

If  the  College  does  not  require  all  employees  to 
acknowledge  the  code  of  conduct  regularly,  the 
policy  might  fail  to  prevent  inappropriate  behaviour. 

Segregation  of  duties  over  payroll 
function — recommendation  repeated 

Background 

In  our  April  2009  Report  (page  91 ),  we 
recommended  that  Lakeland  College: 

• ensure  personnel  have  appropriate  access 
to  make  changes  in  certain  functions  in 
PeopleSoft  payroll 

• implement  a security  matrix  to  ensure  that 
only  appropriate  individuals  are  assigned  the 
authority  to  change  certain  functions 

• review  change  reports  generated  from  the 
payroll  system  for  appropriateness 


Recommendation:  payroll  controls 


RECOMMENDATION  REPEATED 


We  again  recommend  that  Lakeland  College 
adequately  segregate  access  to  the  PeopleSoft 
payroll  system.  We  also  recommend  that 
management  review  change  reports  generated 
from  the  payroll  system  for  appropriateness. 

Criteria:  the  standards  for  our  audit 

The  College  should  have  effective  controls  over 

payroll  by: 

• segregating  the  incompatible  functions  of 
changing  payroll  data  and  processing  payroll 
information 

• generating  reports  of  changes  made  to  payroll 
standing  data  from  the  system  and  reviewing 
all  changes  for  appropriateness 
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Our  audit  findings 


Key  Point 


Security  roles  for  PeopleSoft  not  yet  implemented 

We  found  Lakeland  College  had  made 
little  progress  toward  implementing  this 
recommendation.  In  our  discussion  with 
management,  we  found  the  payroll  security  matrix 
had  not  been  implemented  as  of  June  2010. 

The  College  s human  resources  department  is 
reviewing  the  payroll  security  matrix  to  determine 
which  roles  should  be  given  to  each  payroll 
member  to  ensure  proper  segregation  of  duties. 
Management  expects  the  payroll  security  matrix  to 
be  fully  implemented  in  fiscal  2010-2011 . 


Implications  and  risks  if  recommendation 
not  implemented 

Inappropriate  segregation  of  duties  increases  the 
risk  that  inappropriate  transactions  may  occur.  The 
absence  of  system-generated  change  reporting 
increases  the  risk  that  Lakeland  College  might 
not  detect  an  inappropriate  change  or  error  in  its 
payroll  systems. 

Medicine  Hat  College 

Controls  over  cash,  accounts  receivable 
and  accounts  receivable  write-offs 

Background 

Internal  controls  include  measures  and  practices 
that  management  uses  to  mitigate  exposures 
to  risks  that  could  prevent  an  organization  from 
achieving  its  objectives.  A cornerstone  to  a good 
internal  control  system  is  the  segregation  of 
responsibilities  to  ensure  there  are  no  incompatible 
functions.  Proper  segregation  of  responsibilities 
helps  minimize  the  risk  of  fraud  and  errors  in  the 
financial  statements. 


Recommendation:  controls  over  cash  and 
accounts  receivable 


RECOMMENDATION 


We  recommend  that  Medicine  Hat  College 
improve  controls  over  cash,  accounts  receivable 
and  accounts  receivable  wnte-offs  related  to 
tuition  by: 

• adequately  segregating  incompatible 
functions  of  preparing  daily  cash  receipts, 
processing  accounts  receivable  and  writing 
off  accounts  receivable 

• requiring  registration  clerks  to  use  cash  count 
sheets  for  controlling  cash  handling  and 
reconciling  cash  handovers  to  the  student 
accounts  clerk 

Criteria:  the  standards  for  our  audit 

The  College  should  operate  effective  controls 
over  cash.  These  should  include  segregating 
incompatible  functions  within  receivables  and  areas 
handling  cash,  and  processes  for  handling  cash 


Our  audit  findings 


Key  Point 


Incompatible  functions  performed  by  same  individual 
without  sufficient  independent  review 

We  assessed  the  design  of  the  College's 
controls  over  cash  and  accounts  receivable 
We  saw  the  student  accounts  clerk  performed 
many  incompatible  functions.  This  individual 
is  responsible  for  summarizing  the  daily  cash 
receipts,  processing  accounts  receivable  receipts 
and  has  access  to  writing  off  accounts  receivable 

The  College's  registration  clerks  collecting  cash  do 
not  prepare  cash  count  sheets  at  the  end  of  their 
shifts  Each  clerk  hands  over  their  cash  drawer 
to  the  student  accounts  clerk,  who  performs  the 
daily  cash  counts  and  prepares  cash  summaries 
At  peak  times  during  student  registration,  cash 
receipts  could  range  from  $50,000  to  $60,000 
per  day  If  each  registration  clerk  prepared  count 
sheets  and  handed  them  over  to  the  student 
accounts  clerk  at  the  end  of  their  shift,  the  student 
accounts  clerk  could  use  the  count  sheets  to 
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reconcile  daily  cash  receipts  and  investigate 
and  resolve  any  discrepancies  between  receipts 
recorded  and  cash  collected. 

The  College’s  management  stated  that  some 
compensating  controls  exist  to  reduce  the  risk 
of  fraud  and  error.  These  include  the  approval  of 
accounts  receivable  write-offs  by  the  manager  of 
registration  and  scheduling.  However,  we  found  no 
documentation  to  show  this  approval.  Therefore, 
we  could  not  verify  if  the  compensating  controls 
were  effective. 


Implications  and  risks  if  recommendation 
not  implemented 

Without  appropriate  segregation  of  duties  and 
effective  processes  over  cash  handling  and 
receivables,  Medicine  Hat  College’s  risk  of  fraud 
and  inappropriate  transactions  increases. 

Northern  Alberta  Institute  of 
Technology 

Purchasing  guidelines — implemented 
In  our  April  2010  Report  (page  187),  we 
recommended  that  the  Northern  Alberta  Institute  of 
Technology  (NAIT)  implement  processes  to  ensure: 

• guidance  exists  on  the  steps  required  to 
evaluate  potential  vendors  and  the  documents 
required  to  evidence  that  a review  occurred 

• compliance  with  its  purchasing  guidelines 

• proper  justification  for  all  purchasing  decisions 

We  had  noted  that  NAIT's  documentation  for 
several  purchase  orders  was  inadequate. 

NAIT  has  implemented  the  recommendation 
by  improving  its  guidelines  for  purchase  orders 
and  by: 

• creating  buyer  checklists  for  quotes  and 
tenders,  and  vendor  evaluation  templates 
for  requests  for  purchases  and  requests  for 
tenders 

• centralizing  the  filing  system  for  all  incoming 
and  approved  requests  for  purchases 

We  tested  15  purchase  order  transactions  and 
noted  that  all  purchases  were  in  accordance 


with  NAIT’s  purchasing  guidelines  and  included 
appropriate  documentation  for  the  purchases. 

Olds  College 

Bookstore  sales  and  inventory  controls — 
recommendation  repeated 

We  repeat  this  recommendation  because  the 
results  of  our  audit  indicate  that  Olds  College  made 
unsatisfactory  progress  to  resolve  the  issues  raised 
in  our  April  2010  Report  (page  184). 


Background 

The  College’s  bookstore  is  responsible  for 
purchasing,  selling,  managing  inventories,  and 
keeping  records  for  books  and  other  educational 
items.  The  bookstore  performs  a vital  function 
for  students  and  generates  ancillary  revenue  for 
the  College.  Total  revenue  from  the  bookstore  for 
2009-2010  was  approximately  $947,000.  Last 
year,  we  recommended  that  the  College  strengthen 
its  bookstore  controls.  We  noted  problems  with 
segregation  of  duties  and  access  to  bookstore 
financial  records. 


Recommendation:  improve  internal 
controls 


RECOMMENDATION  REPEATED 


We  again  recommend  that  Olds  College  improve 
internal  controls  in  the  bookstore  relating  to  sales 
and  inventories. 

Criteria:  the  standards  for  our  audit 

The  College  should  have  effective  processes 
and  internal  controls  to  buy,  sell  books  and  other 
inventory,  manage  and  account  for  this  inventory, 
and  keep  records.  Access  to  assets  and  records 
should  be  restricted.  Segregation  of  duties  should 
exist  for  reconciliations,  handling  of  cash  and 
making  orders. 


Our  audit  findings 

The  College  has  not  developed  a plan  to  enhance 
the  bookstore  controls  or  established  a timeframe 
to  make  the  improvements. 
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We  again  found  the  following  internal  control 
deficiencies. 

• no  segregation  of  duties  surrounding  cash — All 
bookstore  employees  are  allowed  to  perform 
daily  cash  reconciliations,  handle  cash  at  the  till 
and  make  deposits  This  restricts  effective  cash 
stewardship  and  record  keeping 

• no  restricted  access  to  the  master  price 
list — All  bookstore  employees  have  access 
to  change  the  master  price  list.  This  restricts 
maintaining  the  integrity  of  data,  and  may  result 
in  undetected  fraud 

• no  sales  till  operator  identification — The  till 
tapes  do  not  identify  which  bookstore  employee 
makes  each  specific  sales  transaction.  This 
restricts  maintaining  accountability  of  staff  for 
individual  transactions. 

• no  reconciliations  of  inventory  count  to  records 
performed — No  investigations  are  done  for 
inventory  discrepancies  to  ensure  accuracy 
and  identify  causes  such  as  theft  of  inventory. 
This  restricts  maintaining  accurate  inventory 
records  and  performing  detailed  analyses 

for  different  types  of  inventory  movement 
throughout  the  year,  and  identifying  potential 
theft  of  inventory. 

Implications  and  risks  if  recommendation 
not  implemented 

Without  appropriate  internal  controls  at  the 
bookstore,  manipulation  of  sales  and  inventory 
data  can  occur  and  go  undetected  for  a significant 
amount  of  time.  This  increases  the  risk  of  fraud 
against  the  College. 

Portage  College 

Inventory  tracking 

Background 

Currently,  Portage  College’s  bookstore  uses  ISBN 
stickers,  manually  created  by  a receiving  clerk  in 
the  warehouse,  to  control  inventory.  For  smaller 
items  such  as  office  supplies,  which  do  not  have 
ISBN  stickers,  any  code  can  be  used  at  the  time  of 
sale,  depending  on  the  knowledge  and  experience 
of  the  cashier.  The  codes  create  confusion  when 
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a product  already  in  inventory  gets  repackaged 
If  a certain  product  looks  different  from  before, 
a receiving  clerk  assigns  a new  code  to  record 
the  received  goods  into  the  system 

At  year-end.  two  College  staff  perform  a physical 
count  of  the  bookstore  inventory  The  results  of  the 
physical  count  are  compared  against  the  College  s 
perpetual  inventory  list  The  bookstore  produces 
an  inventory  reconciliation  report  that  identifies  the 
discrepancies  between  the  perpetual  inventory 
system  and  the  physical  count  This  report  is  sent 
to  the  finance  department 


Recommendation:  improve  controls  over 
bookstore  inventory 


RECOMMENDATION 


We  recommend  that  Portage  College  improve  the 
accuracy  of  its  perpetual  inventory  system  at  the 
bookstore. 


Criteria:  the  standards  for  our  audit 

The  College's  perpetual  inventory  systems  should 
accurately  reflect  the  amount  of  inventory  on  hand 
on  a real-time  basis.  Periodic  physical  inventory 
counts  should  serve  to  verify  the  amounts  recorded 
in  the  system. 


Our  audit  findings 


Key  Points 


• Discrepancies  between  actual  inventory  and 
recorded  inventory  exist 

• Discrepancies  not  investigated,  but  simply 
overwritten  in  system 

We  reviewed  the  inventory  reconciliation  report  and 
noted  numerous  large  discrepancies  between  book 
and  physical  inventory  amounts  In  addition,  some 
inventory  items  were  recorded  in  the  perpetual 
system  as  having  negative  quantities  on  hand 

Physical  count  discrepancies  and  negative 
quantities  for  inventory  can  occur  because 
warehousing  employees  are  authorized  to  assign 
ISBN  numbers  for  products  received  Bookstore 
cashiers  can  enter  sales  using  any  ISBN  number 
in  the  system  This  can  create  negative  quantities 
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and  discrepancies  if  cashiers  record  sales  using 
ISBN  numbers  different  from  the  ones  warehouse 
staff  used  to  receive  the  inventory.  There  are  no 
further  investigations  for  such  discrepancies.  The 
bookstore  staff  simply  make  adjusting  journal 
entries  to  change  book  inventory  to  actual. 


Implications  and  risks  if  recommendation 
not  implemented 

Inventory  tracking  is  an  important  control,  as  it 
helps  Portage  College  provide  accurate  financial 
information  and  prevent  fraud  from  occurring. 

Red  Deer  College 

Control  over  payroll  processes — 
implemented 

Background 

In  our  April  2010  Report  (page  185),  we 
recommended  that  Red  Deer  College  improve  its 
controls  over  payroll.  We  identified  weaknesses 
in  segregation  of  duties  for  payroll  processing, 
documentation  of  employment  contracts,  and  in 
filing  and  retention  of  employment  contracts. 

The  College  implemented  a process  whereby 
human  resource  staff,  independent  from  the 
payroll  unit,  review  all  transactions  that  payroll 
staff  process.  This  review  will  ensure  that  the 
transactions  are  supported  by  appropriate 
documentation  from  other  business  areas.  Also, 
the  College  has  clarified  its  policy  for  retaining  and 
filing  signed  employment  contracts.  The  College  is 
now  filing  employment  contracts  for  new  staff  who 
do  not  participate  in  a collective  bargaining  unit. 


Financial  statements 


We  audited  the  financial  statements,  for  the  year 
ended  June  30,  201 0,  of  the  following: 

• Alberta  College  of  Art  and  Design 

• Bow  Valley  College 

• Grande  Prairie  Regional  College  and  its  related 
entities,  Grande  Prairie  Regional  College 
Foundation  and  Fairview  College  Foundation 


• Grant  MacEwan  University  and  its  related 
entity,  Grant  MacEwan  University  Foundation 

• Keyano  College 

• Lakeland  College 

• Lethbridge  College 

• Medicine  Hat  College 

• Mount  Royal  University 

• NorQuest  College 

• Northern  Alberta  Institute  of  Technology  and  its 
related  entity,  the  Northern  Alberta  Institute  of 
Technology  Foundation 

• Olds  College 

• Portage  College 

• Red  Deer  College 

• Southern  Alberta  Institute  of  Technology 

Our  auditor’s  opinions  on  the  financial  statements 
for  the  above  entities  were  unqualified. 

We  have  not  yet  audited  the  financial  statements 
of  Northern  Lakes  College,  as  management  has 
experienced  significant  difficulty  in  completing  the 
financial  statements  and  providing  us  with  sufficient 
supporting  documentation.  We  will  include  the 
results  of  this  audit  in  our  October  2011  Report. 

Our  October  2011  report  will  also  include  the 
results  of  the  financial  statement  audits  of  the 
following  entities  that  have  a March  31 , 2011 
year-end: 

• Ministry  of  Advanced  Education  and 
Technology 

• Department  of  Advanced  Education  and 
Technology 

• Access  to  the  Future  Fund 

• Alberta  Enterprise  Corporation 

• Alberta  Innovates — Bio  Solutions 

• Alberta  Innovates — Energy  and  Environment 
Solutions 

• Alberta  Innovates — Health  Solutions 

• Alberta  Innovates — Technology  Futures 

• Athabasca  University 

• University  of  Alberta 

• University  of  Calgary 

• University  of  Lethbridge 
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Past  Recommendations 

Report  of  the  Auditor  General  of  Alberta — April  2011 


Outstanding  Recommendations 


This  list  of  outstanding  past  recommendations  is  organized  alphabetically  by  ministry.  Each  section 
includes  outstanding  recommendations  for  a ministry  and  the  entities  that  report  to  it.  Each  section  has 
two  parts,  indicating  where  management  has  informed  us  that  either: 

• the  recommendation  is  still  being  implemented  and  not  ready  for  a follow-up  audit,  or 

• the  recommendation  has  been  implemented  and  is  ready  for  a follow-up  audit. 

We  prioritize  recommendations  in  our  public  reports  as: 

• Key — numbered  recommendations  that  we  believe  are  the  most  significant. 

• Numbered — require  a formal  public  response  from  the  government.  When  implemented,  these 
recommendations  will  significantly  improve  the  safety  and  welfare  of  Albertans,  the  security  and  use 
of  the  province’s  resources,  or  governance  and  ethics  processes  in  government. 

• Unnumbered — although  important,  these  recommendations  do  not  require  a formal  public  response 
from  government.  The  recipient  of  the  recommendation  has  responded  to  us  during  the  audit 
process. 

Recommendations  within  each  section  are  identified  by  a “ ” if  they  were  originally  key 
recommendations,  and  by  a “3+”  if  they  have  been  outstanding  for  three  years  or  more.  Although  we 
recognize  that  some  recommendations  will  take  longer  to  implement,  we  encourage  management  to 
implement  our  key  and  numbered  recommendations  within  three  years.  We  confirm  implementation  of 
recommendations  by  conducting  follow-up  audits. 

We  currently  have  280  outstanding  recommendations — 30  key,  116  numbered  and  134  unnumbered: 


Key 

Numbered 

Unnumbered 

Totals 

Ready  for  follow-up  audits 

7 

35 

49 

91 

Not  yet  ready  for  follow-up  audits 

23 

81 

85 

189 

Total 

30 

116 

134 

280 

Of  these  280  outstanding  recommendations,  58  have  been  outstanding  for  3 years  or  more.  Of  these  58 
recommendations,  8 key  and  26  numbered  recommendations  are  not  yet  ready  for  follow-up  audits. 

The  reports  that  contain  these  recommendations  are  on  our  website  at  www.oag.ab.ca. 


Report  of  the  Auditor  General  of  Alberta 


87 


April  2011 


Outstanding  Recommendations 


Aboriginal  Relations 

There  are  no  outstanding  recommendations  for  this  entity 

Advanced  Education  and  Technology 

Department 

These  recommendations  are  outstanding  and  not  yet  ready  for  follow-up  audits 

Information  technology  control  policies  and  processes — April  2008,  no.  8,  p.  195 
We  recommend  that  the  Department  of  Advanced  Education  and  Technology  (through  the  Campus  Alberta 
Strategic  Directions  Committee)  give  guidance  to  public  post-secondary  institutions  on  using  an  information 
technology  control  framework  to  develop  control  processes  that  are  well-designed,  efficient,  and  effective 

Cross-Institution  recommendations:  Enterprise  risk  management — April  2010,  no.  17,  p.  158 
We  recommend  that  the  Department  of  Advanced  Education  and  Technology  (through  the  Campus  Alberta 
Strategic  Directions  Committee)  work  with  post-secondary  institutions  to  identify  best  practices  and  develop 
guidance  for  them  to  implement  effective  enterprise  risk  management  systems 

Management  has  identified  these  recommendations  as  implemented — to  be  confirmed  with  follow-up  audits 

Non-credit  programs:  Standards  and  expectations — April  2008,  no.  1,  p.  22 

We  recommend  that  the  Department  of  Advanced  Education  and  Technology 

• clarify  its  standards  and  expectations  for  non-credit  programs  and  clearly  communicate  them  to  public 
post-secondary  institutions 

• work  with  institutions  to  improve  the  consistency  of  information  that  institutions  report  to  the  Department 
Non-credit  programs:  Monitoring — April  2008,  no.  2,  p.  23 

We  recommend  that  the  Department  of  Advanced  Education  and  Technology  implement  effective  processes  to 

• monitor  whether  institutions  report  information  consistent  with  its  expectations 

• investigate  and  resolve  cases  where  institutions'  program  delivery  is  inconsistent  with  its  standards  and 
expectations 

Monitoring  vocational  programs  offered  by  private  institutions — April  2008,  p.  42 

We  recommend  that  the  Department  of  Advanced  Education  and  Technology: 

• develop  a risk-based  strategic  audit  plan  of  new  and  follow-up  audits,  including  timelines  and  resources  to 
audit  private  institutions 

• issue  orders  and  information  on  deficiencies  within  a reasonable  time  after  completing  the  audit 

Improve  controls  over  student  finance  program — October  2010,  p.  108 

We  recommend  that  the  Department  of  Advanced  Education  and  Technology  improve  its  controls  over  the  student 
finance  program  by: 

• properly  approving  changes  to  student  loan  programs  and  communicating  the  changes  to  staff 

• reviewing  and  approving  changes  to  assumptions  and  methodologies  used  in  calculating  the  allowance  for 
loan  relief  completion  payments  and  loan  subsidies 

Alberta  College  of  Art  and  Design 

The  following  recommendations  are  outstanding  and  not  yet  ready  for  follow-up  audits 

Bookstore  operations — April  2010,  p.  181 

We  recommend  that  Alberta  College  of  Art  and  Design  maintain  an  effective  system  of  internal  controls  to  enhance 
the  integrity  of  its  bookstore  operations. 

Preserving  endowment  assets — April  2009,  p.  78 

We  recommend  that  Alberta  College  of  Art  and  Design  define  its  goals  for  the  use  and  preservation  of  the 
economic  value  of  endowment  assets  (inflation  proofing). 

Management  has  identified  these  recommendations  as  implemented — to  be  confirmed  with  follow-up  audits 

Information  technology  internal  controls — October  2007,  vol.  2,  p.  21 

We  recommend  that  the  Alberta  College  of  Art  and  Design  strengthen  internal  controls  for  computer  system  access 
and  server  backups.  We  further  recommend  that  the  College  develop  a computer  use  policy. 

Periodic  financial  reporting — April  2010,  p.  160 
(repeated  once  since  April  2008) 

We  again  recommend  that  Alberta  College  of  Art  and  Design  improve  its  processes  and  controls  to  increase 
efficiency,  completeness  and  accuracy  of  financial  reporting 
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Journal  entries — April  2010,  p.  183 

We  recommend  that  Alberta  College  of  Art  and  Design: 

• ensure  journal  entries  entered  into  the  financial  system  are  independently  reviewed  and  approved 

• develop  a policy  that  defines  the  process  for  recording  and  approving  journal  entries  and  the  documentation 
required  to  support  the  entry 

Athabasca  University 

The  following  recommendations  are  outstanding  and  not  yet  ready  for  follow-up  audits: 

Information  technology  governance,  strategic  planning  and  project  management:  Improve  governance  and 
oversight  of  information  technology — October  2010,  no.  1,  p.  21 

We  recommend  that  Athabasca  University  continue  to  improve  its  information  technology  governance  by: 

• developing  an  integrated  information  technology  delivery  plan  that  aligns  with  the  University’s  information 
technology  strategic  plan 

• requiring  business  cases  for  information  technology  projects  that  include  key  project  information  such  as 
objectives,  costs-benefit  assessments,  risks  and  resource  requirements  to  support  the  steering  committees' 
and  executive  committee's  decisions  and  ongoing  project  oversight 

• improving  the  coordination  and  communication  between  the  information  technology  steering  committees  in 
reviewing,  approving  and  overseeing  projects 

Information  technology  governance,  strategic  planning  and  project  management:  Improve  portfolio  and 
project  management  processes — October  2010,  no.  2,  p.  24 

We  recommend  that  Athabasca  University  continue  to  improve  its  portfolio  management  and  project  management 
processes  for  information  technology  projects  by: 

• clarifying  and  communicating  the  mandate  and  authority  of  the  project  management  office 

• setting  project  management  and  architectural  standards,  processes  and  methodologies,  and  training  project 
managers  on  these 

• monitoring  and  enforcing  project  managers’  adherence  to  these  standards,  processes  and  methodologies 

• tracking  and  managing  project  dependencies  on  scope,  risks,  budgets  and  resource  requirements 

Information  technology  governance,  strategic  planning  and  project  management:  Formalize  information 
technology  project  performance  monitoring  and  reporting — October  2010,  p.  25 

We  recommend  that  Athabasca  University  formalize  and  improve  its  monitoring  and  oversight  of  information 
technology  projects  by: 

• improving  its  systems  to  quantify  and  record  internal  project  costs 

• providing  relevant  and  sufficient  project  status  information  to  the  information  technology  steering  and 
executive  committees,  and  summarized  project  information  to  the  Athabasca  University  Governing  Council 
Audit  Committee 

• completing  post-implementation  reviews  on  projects  to  verify  that  expected  objectives  and  benefits  were  met 
and  identify  possible  improvements  to  information  technology  governance,  strategic  planning  and  project 
management  processes 

Information  technology  governance,  strategic  planning  and  project  management:  Resolve  inefficiencies  in 
financial,  human  resources  and  payroll  systems — October  2010,  p.  27 

We  recommend  that  Athabasca  University  complete  its  plans  to  resolve  the  inefficiencies  in  its  financial,  human 
resources  and  payroll  systems. 

Establish  information  technology  resumption  capabilities — October  2010,  no.  10,  p.  Ill 

We  recommend  that  Athabasca  University: 

• assess  the  risks  and  take  the  necessary  steps  to  establish  appropriate  off-site  disaster  recovery  facilities  that 
include  required  computer  infrastructure  to  provide  continuity  of  critical  information  technology  systems 

• complete  and  test  its  existing  disaster  recovery  plan  to  ensure  continuous  services  are  provided  in  the  event 
of  a disaster 

Grant  MacEwan  University 

The  following  recommendations  are  outstanding  and  not  yet  ready  for  follow-up  audits: 

3+  Construction  management — November  2006,  no.  9,  p.  35 

We  recommend  Grant  MacEwan  University  ensure  that  signed  contracts  (interim  or  final)  for  construction  projects 
are  in  place  before  projects  start. 

Systems  over  costs  for  internal  working  sessions  and  hosting  guests — April  2010,  p.  165 
We  recommend  that  Grant  MacEwan  University: 

• implement  policies  and  guidance  on  appropriate  expenses  for  events  related  to  internal  working  sessions  and 
for  hosting  guests 

• follow  its  policies  and  processes  for  employee  expense  claims  and  corporate  credit  cards 
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Preserve  endowment  assets — April  2010,  p.  170 

We  recommend  that  Grant  MacEwan  University  improve  its  endowment  and  related  investment  policies  and 
procedures  by 

• establishing  and  regularly  reviewing  a spending  policy  for  endowments 

• improving  its  processes  to  review  its  endowment  related  investments 

• improving  its  reporting  of  investments  and  endowments  to  the  audit  and  finance  committee 

Improve  and  implement  University  policies — April  2010,  no.  18,  p.  174 

We  recommend  that  Grant  MacEwan  University  improve  its  control  environment  by  implementing  or  improving 

• a code  of  conduct  and  ethics  policy  and  a process  for  staff  to  acknowledge  they  will  adhere  to  its  policies 

• a process  for  staff  to  annually  disclose  potential  conflicts  of  interest  in  writing  so  the  University  can  manage 
them  proactively 

• a safe  disclosure  policy  and  procedure  to  allow  staff  to  report  incidents  of  suspected  or  actual  frauds  or 
irregularities 

• a responsibility  statement  in  its  annual  report  to  acknowledge  management's  role  in  maintaining  an  effective 
control  environment 

Adhere  to  signing  authority  limits — April  2010,  p.  176 

We  recommend  that  Grant  MacEwan  University  improve  its  processes  to  ensure  appropriate  staff  with  proper 
signing  authority  approve  contracts  and  purchases. 

Management  has  identified  these  recommendations  as  implemented — to  be  confirmed  with  follow-up  audits 

Computer  control  environment — October  2005,  p.  104 

We  recommend  that  Grant  MacEwan  University  resolve  identified  deficiencies  and  strengthen  the  overall  control 
framework  in  the  information  technology  environment. 

Bookstore  Operations — April  2008,  p.  186 

We  recommend  that  Grant  MacEwan  University  improve  its  systems  to: 

• manage  and  report  inventories 

• monitor  and  account  for  the  use  of  petty  cash 

Parking  services  fees — April  2009,  p.  82 

We  recommend  that  Grant  MacEwan  University  improve  its  systems  to  control,  collect  and  account  for  parking 
services  fees 

Capital  assets — April  2009,  p.  85 

We  recommend  that  Grant  MacEwan  University  improve  its  capital  asset  processes  by 

• documenting  its  assessment  on  the  appropriate  accounting  treatment  for  costs  related  to  construction  and 
renovation  projects 

• coding  and  recording  transactions  accurately  the  first  time 

Lakeland  College 

The  following  recommendation  is  outstanding  and  not  yet  ready  for  a follow-up  audit 

Improve  payroll  controls — April  2009,  p.  91 

We  recommend  that  Lakeland  College: 

• adequately  segregate  staff  access  to  the  PeopleSoft  payroll  system  to  ensure  only  valid  changes  are  made 

• review  change  reports  generated  from  the  payroll  system  for  appropriateness 

• prepare  monthly  reconciliations  of  the  payroll  system  to  the  general  ledger  and  promptly  review  the 
reconciliations 

NorQuest  College 

Management  has  identified  these  recommendations  as  implemented — to  be  confirmed  with  a follow-up  audit 

Procurement  cards:  Discrepancy  log — April  2009,  p.  88 

We  recommend  that  NorQuest  College  improve  controls  to  ensure  that  procurement  cardholders  comply  with  its 
procurement  card  policy. 

Procurement  cards:  Compliance  with  procedure  card  policy — April  2009,  p.  89 

We  recommend  that  NorQuest  College  ensure  that  its  procurement  card  statements  are  supported  by  adequate 
documentation  and  are  approved  by  an  authorized  individual  before  making  payments 

Bookstore  services:  Segregation  of  duties  in  the  bookstore — April  2010,  p.  186 

We  recommend  that  NorQuest  College  implement  proper  segregation  of  duties  within  its  bookstore  services 
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Olds  College 

The  following  recommendation  is  outstanding  and  not  yet  ready  for  a follow-up  audit: 

Improve  bookstore  sales  and  inventory  control — April  2010,  p.  181 

We  recommend  that  Olds  College  improve  internal  controls  in  the  bookstore  relating  to  sales  and  inventories. 

Portage  College 

The  following  recommendation  is  outstanding  and  not  yet  ready  for  a follow-up  audit: 

Periodic  financial  reporting — April  2010,  p.  160 

We  recommend  that  Portage  College  improve  its  financial  reporting  to  the  Board  and  senior  management  by 
providing — at  least  quarterly — complete  financial  statements  of  financial  position  and  actual  year-to-date  operating 
results. 

Red  Deer  College 

The  following  recommendation  is  outstanding  and  not  yet  ready  for  a follow-up  audit: 

Systems  over  costs  for  internal  working  sessions  and  hosting  guests — April  2010,  p.  167 
We  recommend  that  Red  Deer  College: 

• implement  policies  and  guidance  on  appropriate  expenses  for  internal  working  sessions  and  hosting  guests 

• strengthen  its  processes  to  ensure  staff  follows  its  policies  and  processes  for  employee  expense  claims  and 
corporate  credit  cards 

University  of  Alberta 

The  following  recommendation  is  outstanding  and  not  yet  ready  for  a follow-up  audit: 

Systems  over  costs  for  internal  working  sessions  and  hosting  guests — April  2010,  p.  167 

We  recommend  that  the  University  of  Alberta  follow  its  policies  and  processes  for  employee  expense  claims  and 
corporate  credit  cards. 

Management  has  identified  this  recommendation  as  implemented — to  be  confirmed  with  a follow-up  audit: 

Strategic  planning  for  research — October  2004,  p.  252 

We  recommend  that  the  University  of  Alberta  improve  the  integration  of  research  into  its  strategic  business  plan  by 
ensuring  that: 

• key  performance  measures  and  targets  are  identified  with  each  strategy  indicated  in  the  plan 

• the  costs  of  achieving  these  targets  are  considered  when  making  budget  allocation  decisions 

• the  faculty  and  other  research  administrative  unit  plans  set  out  in  clear,  consistent  terms,  the  extent  to  which 
faculties  and  units  are  planning  to  contribute  to  the  achievement  of  these  targets 

University  of  Calgary 

The  following  recommendations  are  outstanding  and  not  yet  ready  for  follow-up  audits: 

Improving  the  control  environment — October  2008,  no.  21,  p.  213 

We  recommend  that  the  University  of  Calgary  improve  the  effectiveness  of  its  control  environment  by: 

• assessing  whether  the  current  mix  of  centralized  and  decentralized  controls  is  appropriate  to  meet  its 
business  needs 

• defining  clear  roles,  responsibilities  and  accountabilities  for  control  systems’  design,  implementation,  and 
monitoring 

• documenting  its  decentralized  control  environment  and  implementing  training  programs  to  ensure  those 
responsible  for  business  processes  have  adequate  knowledge  to  perform  their  duties 

• monitoring  decentralized  controls  to  ensure  processes  operate  effectively 

Controls  over  payroll — October  2009,  p.  153 
(repeated  twice  since  October  2007) 

We  again  recommend  that  the  University  of  Calgary  improve  controls  over  payroll  functions. 

Systems  over  costs  for  internal  working  sessions  and  hosting  guests — April  2010,  p.  166 

We  recommend  that  the  University  of  Calgary: 

• implement  policies  and  guidance  on  appropriate  expenses  for  internal  working  sessions  and  hosting  guests 

• follow  its  policies  and  processes  for  employee  expense  claims  and  corporate  credit  cards 

3+  Research  management:  Improve  human  resource  plans  and  system  for  cost  planning  to  quantify  and 
budget  for  indirect  costs — October  2010,  no.  4,  p.  46 
(repeated  once  since  October  2004) 

We  again  recommend  that  the  University  of  Calgary  improve  its  human  resources  plans  and  develop  a system  to 
quantify  and  budget  for  the  indirect  costs  of  research. 

3+  Research  management:  Define  research  management  roles  and  responsibilities — October  2010,  no.  5,  p.  48 
(repeated  once  since  October  2005) 

We  again  recommend  that  the  University  of  Calgary  define  research  management  roles  and  responsibilities. 
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3+  Research  management:  Maintain  current  and  comprehensive  research  policies — October  2010,  no.  6,  p 50 
(repeated  once  since  October  2005) 

We  again  recommend  that  the  University  of  Calgary  ensure  all  research  policies  are  current  and  comprehensive 
Specifically,  the  policies  should  identify  who  is  responsible  for  monitoring  compliance 

Research  management:  Use  project  management  tools  for  large,  complex  projects — October  2010,  p.  52 
(repeated  once  since  October  2005) 

We  again  recommend  that  the  University  of  Calgary  and  its  faculties  use  project  management  tools  for  large 
complex  projects  to  ensure  research  is  cost  effective 

3+  PeopleSoft  security:  Improve  access  to  data  and  systems — October  2010,  no.  11,  p.  112 
(repeated  four  times  since  October  2006) 

We  again  recommend  that  the  University  of  Calgary  improve  controls  in  the  PeopleSoft  system  by 

• finalizing  and  implementing  the  security  policy  and  the  security  design  document 

• ensuring  that  user  access  privileges  are  consistent  with  both  the  user  s business  requirements  and  the 
security  policy 

Management  has  identified  this  recommendation  as  implemented — to  be  confirmed  with  a follow-up  audit 

3+  Information  technology  governance  and  control  framework — October  2007,  no.  18,  vol.  2,  p.  10 

We  recommend  that  the  University  of  Calgary  implement  an  information  technology  governance  and  control 
framework 

University  of  Lethbridge 

The  following  recommendations  are  outstanding  and  not  yet  ready  for  follow-up  audits 

3+  Information  technology  internal  control  framework — October  2007,  no.  21,  vol.  2,  p.  23 

We  recommend  that  the  University  of  Lethbridge  implement  an  information  technology  control  framework 

Improve  endowment  policies — October  2010,  p.  118 

We  recommend  that  the  University  of  Lethbridge  improve  its  endowment  policies  and  procedures  by: 

• clarifying  its  goals  for  preserving  the  real  value  of  endowments,  and  how  it  plans  to  achieve  this 

• tracking  investment  income  between  amounts  for  preserving  the  real  value  of  investments  and  amounts 
available  for  spending 

Management  has  identified  these  recommendations  as  implemented — to  be  confirmed  with  follow-up  audits 

Financial  research  roles  and  responsibilities — October  2008,  p.  225 

We  recommend  that  the  University  of  Lethbridge  clearly  define  and  communicate  the  financial  research- 
management  roles  and  responsibilities  of  research  services,  financial  services  and  deans 

Clear  and  complete  research  policies — October  2008,  p.  227 
We  recommend  that  the  University  of  Lethbridge  improve  systems  to  ensure  that 

• financial  research  policies  are  current  and  comprehensive 

• proper  documentation  is  maintained  for  approving  research  accounts 

• researchers,  research  administrators  and  financial  services  staff  are  aware  of  changes  to  financial  policies 

and  are  properly  trained  to  comply  with  the  policies 

Processes  for  investing  in  research  projects — April  2009,  no.  1,  p.  26 

We  recommend  that  the  University  of  Lethbridge: 

• strengthen  processes  for  assessing  risks  and  benefits  relating  to  prospective  business  relationships 

• strengthen  processes  to  oversee  and  monitor  financial  and  other  risks  throughout  the  life  of  business 
relationships 

• periodically  report  to  the  Board  of  Governors  key  information  on  financial  and  other  risks  in  research 
management 

Agriculture  and  Rural  Development 

Department 

Management  has  identified  these  recommendations  as  implemented — to  be  confirmed  with  follow-up  audits 

0— r Evaluating  program  success:  grant  management — October  2005,  no.  20,  p.  113 

(repeated  once  since  October  2001) 

We  again  recommend  that  the  Department  of  Agriculture.  Food  and  Rural  Development  evaluate  the  performance 
of  its  grant  programs  in  meeting  Ministry  goals.  This  includes  evaluating  the  grant  programs  themselves,  as  well  as 
individual  grants  under  the  programs 
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3+  Food  safety:  Alberta  Agriculture’s  surveillance  program — October  2006,  no.  9,  vol.  1,  p.  88 

We  recommend  that  the  Department  of  Agriculture,  Food  and  Rural  Development  improve  the  administration  of  its 
food  safety  surveillance  program.  This  includes: 

• documenting  its  prioritization  processes 

• involving  partners  in  the  prioritization  of  projects 

• ensuring  conditions  for  the  approval  of  specific  projects  are  met  and  final  approval  recorded 

• capturing  costs  for  large  projects 

• monitoring  the  impact  of  surveillance  projects 

• considering  whether  regulatory  support  for  the  program  is  required 

Food  safety:  Alberta  Agriculture’s  food  safety  information  systems — October  2006,  vol.  1,  p.  94 

We  recommend  that  the  Department  of  Agriculture,  Food  and  Rural  Development  improve  its  food  safety 
information  systems.  This  includes: 

• improving  security  and  access  controls 

• ensuring  complete,  timely,  and  consistent  data  collection,  and 

• ensuring  data  gets  onto  the  computerized  data  base 

Monitoring  information  technology  security  policy — October  2006,  vol.  2,  p.  40 
We  recommend  that  the  Department  of  Agriculture,  Food  and  Rural  Development: 

• document,  approve  and  communicate  to  employees  and  contractors  its  information  technology  security 
policies  and  standards 

• implement  a process  to  monitor  compliance  by  employees  and  contractors  with  information  technology 
security  policies  and  standards 

3+  Reporting  and  dealing  with  allegations  of  employee  misconduct — November  2006,  no.  12,  p.  46 

We  recommend  that  the  Department  of  Agriculture,  Food  and  Rural  Development  improve  its  systems  for  reporting 
and  dealing  with  allegations  of  employee  misconduct. 

Agriculture  and  Rural  Development  and  Health  and  Wellness 

The  following  recommendations  are  outstanding  and  not  yet  ready  for  follow-up  audits: 

3+  Food  safety:  Integrated  food  safety  planning  and  activities — October  2009,  no.  11  , p.  107 
(repeated  once  since  October  2006) 

We  again  recommend  that  the  Departments  of  Health  and  Wellness  and  Agriculture  and  Rural  Development,  in 
cooperation  with  Alberta  Health  Services  and  federal  regulators,  improve  planning  and  coordination  of  food  safety 
activities  and  initiatives.  This  includes: 

• each  provincial  ministry  defining  its  own  food  safety  policies,  objectives  and  measures  (satisfactory  progress) 

• coordinating  provincial  food  safety  policies  and  planning  so  initiatives  are  integrated  (satisfactory  progress) 

• ensuring  provincial  approaches  align  with  initiatives  being  developed  through  federal/provincial/territorial 
committees  (satisfactory  progress) 

• improving  day-to-day  coordination  of  provincial  food  safety  activities 

• encouraging  the  joint  application  of  HACCP  and  HACCP  related  programs  in  Alberta,  and  (satisfactory 
progress) 

• improving  cooperation  and  working  relationships  among  provincial  and  federal  partners  such  as  the  First 
Nations  and  Inuit  Health  Branch  and  the  Canadian  Food  Inspection  Agency 

3+  Food  safety:  Accountability — October  2009,  no.  13,  p.  114 
(repeated  once  since  October  2006) 

We  again  recommend  that  the  Departments  of  Health  and  Wellness  and  Agriculture  and  Rural  Development 
improve  reporting  on  food  safety  in  Alberta. 

Agriculture  and  Rural  Development,  Health  and  Wellness  and  Alberta  Health  Services 

Management  has  identified  this  recommendation  as  implemented — to  be  confirmed  with  a follow-up  audit: 

3+  Food  safety:  Eliminating  gaps  in  food  safety  inspection  coverage — October  2009,  no.  12,  p.  Ill 
(repeated  once  since  October  2006) 

We  again  recommend  that  Alberta  Health  Services  and  the  Departments  of  Health  and  Wellness  and  Agriculture 
and  Rural  Development,  working  with  federal  regulators,  eliminate  the  existing  gaps  in  food  safety  coverage  in 
Alberta.  Gaps  include: 

• mobile  butchers 

• consistently  administering  the  Meat  Facility  Standard 

• coordinating  inspections  in  the  “non-federally  registered”  sector 
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Agriculture  Financial  Services  Corporation 

The  following  recommendation  is  outstanding  and  not  yet  ready  for  a follow-up  audit 

Improve  processes  for  conducting  compliance  audits — October  2010,  no.  12,  p.  124 

We  recommend  Agriculture  Financial  Services  Corporation  improve  its  processes  for  conducting  compliance  audits 
and  investigations  by 

• clearly  defining  the  roles  and  responsibilities  of  the  Program  Cross  Compliance  and  Investigations  Group 

• improving  the  coordination  between  the  Program  Cross  Compliance  and  Investigations  Group  and  program 
areas 

Management  has  identified  these  recommendations  as  implemented — to  be  confirmed  with  follow-up  audits 

Loan  loss  processes — October  2007,  vol.  2,  p.  32 

We  recommend  that  the  Agriculture  Financial  Services  Corporation  improve  its  loan  loss  methodology  and 
processes  by: 

• developing  guidelines  to  assess  which  loans  are  impaired 

• incorporating  historical  loan  loss  experience 

• periodically  updating  data  used  in  the  methodology 

Information  technology  risk  assessment  and  control  framework — October  2009,  p.  168 

We  recommend  that  Agriculture  Financial  Services  Corporation: 

• complete  an  information  technology  risk  assessment  to  identify  and  rank  the  risks  within  its  computing 
environment,  linking  to  business  objectives  and 

• design  and  implement  information  technology  controls  to  mitigate  the  risks  it  identifies 

Verify  accuracy  of  specific  loan  loss  allowance — October  2010,  p.  122 

We  recommend  that  Agriculture  Financial  Services  Corporation  improve  the  effectiveness  of  processes  to 
determine  the  specific  loan  loss  allowance  on  impaired  loans. 

Children  and  Youth  Services 

Department 

The  following  recommendations  are  outstanding  and  not  yet  ready  for  follow-up  audits 

3+  Child  intervention  services:  Accreditation  systems  for  service  providers — October  2007,  no.  7,  vol.  1,  p.  82 
We  recommend  that  the  Department  of  Children's  Services  evaluate  the  cost-effectiveness  of  accreditation 
systems  and  the  assurance  they  provide. 

Child  intervention  services:  Department  compliance  monitoring — October  2007,  no.  8,  vol.  1,  p.  83 
We  recommend  that  the  Department  of  Children's  Services  improve  compliance  monitoring  processes  by 
3+  • incorporating  risk-based  testing  in  case-file  reviews 

• providing  feedback  to  caseworkers  on  monitoring  results  of  case-file  reviews 

• obtaining  and  analyzing  information  on  Authorities'  monitoring  of  service  providers 

Department  and  Child  and  Family  Services 

Daycare  and  day  home  regulatory  compliance  monitoring.  Documentation  and  training — 

October  2010,  p.  37 

We  recommend  that  the  Department  of  Children  and  Youth  Services,  working  with  the  Child  and  Family  Services 
Authorities,  review  documentation  and  training  requirements  for  monitoring  licensed  and  approved  programs  to 
ensure  requirements  are  being  met. 

Child  and  Family  Services  Authorities 

The  following  recommendations  are  outstanding  and  not  yet  ready  for  follow-up  audits: 

Child  intervention  services:  Authorities  compliance  monitoring  processes — October  2007,  vol.  1,  p.  86 

We  recommend  that  the  Child  and  Family  Services  Authorities  improve  compliance  monitoring  processes  by 
providing  caseworkers  with: 

• training  on  file  preparation  and  maintenance 

• feedback  from  the  monitoring  results  of  case-file  reviews 

Child  intervention  services:  Authorities  monitoring  of  service  providers — October  2007,  vol.  1,  p.  88 
We  recommend  that  the  Child  and  Family  Services  Authorities  improve  the  evaluation  of  service  providers  by 
coordinating  monitoring  activities  and  sharing  the  results  with  the  Department 
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Daycare  and  day  home  regulatory  compliance  monitoring:  Improve  consistency  of  monitoring — 

October  2010,  p.  38 

We  recommend  that  Child  and  Family  Services  Authorities  improve  systems  to  ensure  their  consistent  compliance 
with  monitoring  and  enforcement  policies  and  processes. 

Daycare  and  day  home  regulatory  compliance  monitoring:  Improve  follow-up  processes — 

October  2010,  no.  3,  p.  39 

We  recommend  that  Child  and  Family  Services  Authorities  improve  systems  for  monitoring  and  enforcing  child  care 
program  compliance  with  statutory  requirements  and  standards  by  ensuring  that  all  verbal  warnings  are  adequately 
documented  and  resolved. 

Culture  and  Community  Spirit 

Ministry  and  Tourism,  Parks  and  Recreation 

The  following  recommendation  is  outstanding  and  not  yet  ready  for  a follow-up  audit: 

Computer  control  environment — October  2007,  vol.  2,  p.  172 

We  recommend  that  the  Ministry  of  Tourism,  Parks,  Recreation  and  Culture  work  with  Service  Alberta  to: 

• document  the  services  that  Service  Alberta  is  to  provide  and  its  control  environment  for  information  technology 

• implement  a process  to  ensure  that  Service  Alberta  consistently  meets  service  level  and  security  requirements 

• provide  evidence  that  control  activities  maintained  by  Service  Alberta  are  operating  effectively 

Education 

Ministry  and  Department 

The  following  recommendation  is  outstanding  and  not  yet  ready  for  a follow-up  audit: 

Business  cases — October  2007,  vol.  2,  p.  45 

We  recommend  that  the  Department  of  Education  establish  a policy  for  developing  business  cases. 

Management  has  identified  these  recommendations  as  implemented — to  be  confirmed  with  follow-up  audits: 

School  board  budget  process — October  2006,  no.  25,  vol.  2,  p.  65 
We  recommend  that  Alberta  Education  improve  the  school  board  budget  process  by: 

3+  • providing  school  boards  as  early  as  possible  with  the  information  needed  to  prepare  their  budgets  (e  g. 

estimates  of  operating  grant  increases  and  new  grant  funding,  and  comments  on  financial  condition  evident 
from  their  latest  audited  financial  statements) 

• requiring  school  boards  to  use  realistic  assumptions  for  planned  activities  and  their  costs  and  to  disclose  key 
budget  assumptions  to  their  trustees  and  the  Ministry 

• establishing  a date  for  each  school  board  to  give  the  Ministry  a trustee-approved  revised  budget  based  on 
actual  enrolment  and  prior  year  actual  results 

• reassessing  when  and  how  the  Ministry  should  take  action  to  prevent  a school  board  from  incurring  an 
accumulated  operating  deficit 

g School  board  interim  reporting — October  2006,  no.  26,  vol.  2,  p.  68 

We  recommend  that  Alberta  Education  work  with  key  stakeholder  associations  to  set  minimum  standards  for  the 
3+  financial  monitoring  information  provided  to  school  board  trustees. 

We  also  recommend  that  Alberta  Education  work  with  the  key  stakeholder  associations  to  provide  information  to 
trustees  about: 

• the  characteristics  of  a strong  budgetary  control  system 

• best  practices  for  fulfilling  financial  monitoring  responsibilities 

Northland  School  Division  No.  61 

The  following  recommendations  are  outstanding  and  not  yet  ready  for  follow-up  audits: 

Obtaining  an  interest  in  land — October  2010,  no.  13,  p.  133 

We  recommend  that  Northland  School  Division  No.  61  develop  processes  to  ensure  it  obtains  a valid  legal  interest 
in  land  before  beginning  construction  of  schools. 

Improving  financial  reporting — October  2010,  no.  14,  p.  134 

We  recommend  that  the  Northland  School  Division  No.  16  improve  its  financial  reporting  by: 

• preparing  and  presenting  quarterly  financial  information  to  the  Official  Trustee 

• regularly  reviewing  and  reconciling  general  ledger  accounts 

• preparing  year-end  financial  statements  promptly 
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Employment  and  Immigration 

Department 

The  following  recommendations  are  outstanding  and  not  yet  ready  for  follow-up  audits 

Approving  and  renewing  training  programs — October  2008,  p.  249 

We  recommend  that  the  Department  of  Employment  and  Immigration  improve  rts  systems  for  approving  and 
renewing  programs  by: 

• clearly  defining  criteria  for  approving  each  program 

• developing  clear  performance  expectations  for  each  program  and  training  provider 

• using  its  monitoring  results  to  decide  whether  to  renew  a program 

Improving  the  use  of  information  systems — October  2008,  p.  251 

We  recommend  that  the  Department  of  Employment  and  Immigration  improve  the  use  of  its  information  systems 
by: 

• integrating  its  payment-processing  system  with  other  learner  databases  to  ensure  that  tuition  fee  payments 
are  accurate 

• implementing  adequate  controls  to  ensure  all  key  learner  data  is  promptly  updated  in  the  system 

• using  exception  reports  to  detect  potential  non-compliance  problems 

Occupational  Health  and  Safety:  Promoting  and  enforcing  compliance — April  2010,  no.  3,  p.  39 

We  recommend  that  the  Department  of  Employment  and  Immigration  enforce  compliance  with  the  Occupational 
Health  and  Safety  Act  by  employers  and  workers  who  persistently  fail  to  comply 

Occupational  Health  and  Safety:  Work  Safe  Alberta  planning  and  reporting — April  2010,  p.  43 

We  recommend  that  the  Department  of  Employment  and  Immigration  improve  its  planning  and  reporting  systems 
for  occupational  health  and  safety  by: 

• obtaining  data  on  chronic  injuries  and  diseases  to  identify  potential  occupational  health  and  safety  risks 

• completing  the  current  update  of  the  Work  Safe  Alberta  Strategic  Plan 

• measuring  and  reporting  performance  of  occupational  health  and  safety  programs  and  initiatives  that  support 
key  themes  of  the  Plan 

Occupational  Health  and  Safety:  Inspection  systems — April  2010,  p.  46 

We  recommend  that  the  Department  of  Employment  and  Immigration  strengthen  its  proactive  inspection  program 
by  improving  risk  focus  and  coordinating  employer  selection  methods  for  its  inspection  initiatives 

Occupational  Health  and  Safety:  Certificate  of  Recognition — April  2010,  p.  48 

We  recommend  that  the  Department  of  Employment  and  Immigration  improve  its  systems  to  issue  Certificates  of 
Recognition  by: 

• obtaining  assurance  on  work  done  by  Certificate  of  Recognition  auditors 

• consistently  following-up  on  recommendations  made  to  certifying  partners 

Occupational  Health  and  Safety:  Legislated  permit  and  certificate  programs — April  2010,  p.  50 
We  recommend  that  the  Department  of  Employment  and  Immigration  strengthen  the  legislated  permit  and 
certificate  programs  by  improving: 

• control  over  issued  asbestos  certificates 

• processes  for  approval  and  monitoring  of  external  training  agencies 

Management  has  identified  these  recommendations  as  implemented — to  be  confirmed  with  follow-up  audits 

Monitoring  and  enforcement  of  training  providers — October  2008,  no.  24,  p.  245 

We  recommend  that  the  Department  of  Employment  and  Immigration  improve  its  monitoring  of  tuition-based 
training  providers  by: 

• assessing  whether  performance  expectations  are  being  met 

• quantifying  tuition  refunds  that  may  be  owing  to  the  Department 

• implementing  policies  and  procedures  that  outline  steps  and  timelines  for  dealing  with  non-compliance 
problems 

Fraud  investigation  processes — October  2009,  p.  186 

We  recommend  that  the  Department  of  Employment  and  Immigration  improve  the  processes  of  its  investigation 
units  by: 

• defining  clear  objectives  for  investigation  units 

• establishing  guidelines  for  determining  when  they  should  undertake  a fraud  investigation 

• providing  fraud-specific  training  for  investigation  unit  staff 
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Internal  audits  and  home  visits — October  2009,  p.  189 

We  recommend  that  the  Department  of  Employment  and  Immigration  improve  its  processes  by  developing: 

• timelines  and  strategies  to  respond  to  findings  arising  from  internal  audits 

• a risk-based  approach  to  augment  the  random  sample  selection  method  currently  used  for  internal  audits  and 
home  visits 

Workers’  Compensation  Board 

Management  has  identified  these  recommendations  as  implemented — to  be  confirmed  with  follow-up  audits: 

Access  and  security  monitoring — October  2009,  p.  192 

We  recommend  that  the  Workers’  Compensation  Board  formalize  its  security  monitoring  procedures  to  ensure  that 
security  threats  to  critical  information  systems  are  detected  in  a timely  manner. 

Computer  access — October  2010,  p.  136 

We  recommend  that  the  Workers’  Compensation  Board  ensure  that  access  to  computer  systems  is  restricted  to 
appropriate  staff. 

Energy 

Department 

The  following  recommendation  is  outstanding  and  not  yet  ready  for  a follow-up  audit: 

Royalty  regime:  Improving  annual  performance  measures — October  2007,  no.  11,  vol.  1,  p.  124 

We  recommend  that  the  Department  of  Energy  improve  its  annual  performance  measures  that  indicate  royalty 
regime  results. 

Management  has  identified  these  recommendations  as  implemented — to  be  confirmed  with  follow-up  audits: 

Documenting  potential  conflicts  of  interest — April  2008,  p.  57 

We  recommend  that  the  Department  of  Energy  follow  its  own  policies  and  processes  by  ensuring  discussions, 
conclusions,  and  actions  taken — including  the  risk-mitigation  strategy — when  an  employee  has  declared  a potential 
conflict  of  interest  are  clearly  documented  and  retained. 

Alberta’s  bioenergy  programs — October  2008,  no.  25,  p.  255 
We  recommend  that  the  Department  of  Energy: 

• undertake  and  document  its  analysis  to  quantify  the  environmental  benefits  of  potential  bioenergy 
technologies  to  be  supported  in  Alberta 

• establish  adherence  to  the  Nine  Point  Bioenergy  Plan  as  a criterion  within  its  bioenergy  project  review 
protocol,  and  require  grant  applications  to  indicate  the  projected  environmental  benefits  of  proposed  projects 

• prior  to  awarding  grants  in  support  of  plant  construction,  require  successful  applicants  to  quantify — with  a life 
cycle  assessment — the  positive  environmental  impact  relative  to  comparable  non-renewable  energy  products 

Improving  processes  to  prepare  financial  information — October  2009,  p.  197 
We  recommend  that  the  Department  of  Energy  improve: 

• internal  communication  processes  between  the  Finance  branch  and  program  staff 

• quality  control  processes  for  the  preparation  of  working  papers  and  financial  statements 

• the  timely  completion  of  accurate  financial  information 

Sustaining  the  continued  accuracy  of  the  revenue  forecast  system — October  2009,  no.  21,  p.  199 

We  recommend  that  the  Department  of  Energy  improve  the  controls  and  documentation  supporting  the  revenue 
forecast  model  to  help  ensure  the  continued  accuracy  of  the  forecast  system. 

Energy  Resources  Conservation  Board 

The  following  recommendation  is  outstanding  and  not  yet  ready  for  a follow-up  audit: 

3+  Liability  management  for  suspension,  abandonment  and  reclamation  activities — 

October  2005,  no.  30,  p.  173 

We  recommend  that  the  Energy  Resources  Conservation  Board  improve  its  systems  by  monitoring  the  timeliness 
in  which  industry  restores  wells,  facilities  and  pipelines  to  a safe  and  stable  condition  after  permanent  dismantling 

Management  has  identified  this  recommendation  as  implemented — to  be  confirmed  with  a follow-up  audit: 

3+  Information  technology  control  framework — October  2007,  no.  24,  vol.  2,  p.  71 

We  recommend  that  the  Energy  Resources  Conservation  Board  implement  an  information  technology  control 
framework  to  mitigate  identified  risks  to  the  organization. 
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Environment 

Ministry  and  Department 

The  following  recommendations  are  outstanding  and  not  yet  ready  for  follow-up  audits 

Climate  change:  Monitoring  processes — October  2008,  no.  10,  p.  100 

We  recommend  that  for  each  major  action  in  the  2008  Climate  Change  Strategy  the  Ministry  of  Environment 
evaluate  the  action's  effect  in  achieving  Alberta  s climate  change  goals 

Climate  change:  Public  reporting — October  2008,  no.  11,  p.  101 

We  recommend  that  the  Ministry  of  Environment  improve  the  reliability,  comparability  and  relevance  of  its  public 
reporting  on  Alberta  s success  and  costs  incurred  in  meeting  climate-change  targets 

Climate  change:  Data  quality — October  2009,  p.  40 

We  recommend  that  the  Department  of  Environment  strengthen  its  guidance  for  baseline  and  compliance  reporting 
by: 

• clarifying  when  uncertainty  calculations  must  be  done 

• prescribing  the  minimum  required  quality  standards  for  data  in  terms  of  minimum  required  frequency  of 
measurement  and  connection  to  the  period  being  reported  on 

• describing  the  types  of  data  controls  that  facilities  should  have  in  place 

Climate  change:  Guidance  to  verifiers  of  facility  baseline  and  compliance  reports — 

October  2009,  no.  3,  p.  42 

We  recommend  that  the  Department  of  Environment  strengthen  its  baseline  and  compliance  guidance  for  verifiers 
by  improving  the  description  of  the  requirements  for: 

• the  nature  and  extent  of  testing  required 

• the  content  of  verification  reports 

• assurance  competencies 

Climate  change:  Technical  review — October  2009,  p.  45 

We  recommend  that  the  Department  of  Environment  strengthen  its  technical  review  processes  by 

• requiring  facilities  to  provide  a process  map  with  their  compliance  reporting  and 

• ensuring  staff  document  their  follow-up  activity  and  decisions  in  the  Department's  regulatory  database 

Climate  change:  Use  of  offsets  to  meet  compliance  obligations — October  2009,  no.  4,  p.  46 
We  recommend  that  the  Department  of  Environment: 

• strengthen  its  offset  protocols  to  have  sufficient  assurance  that  offsets  used  for  compliance  are  valid 

• assess  the  risk  of  offsets  applied  in  Alberta  having  been  used  elsewhere  in  the  world 

Climate  change:  Outsourced  service  providers — October  2009,  p.  49 

We  recommend  that  the  Department  of  Environment  develop  controls  to  gain  assurance  that  data  hosted  or 
processed  by  third  parties  is  complete  accurate  and  secure. 

We  also  recommend  that  the  Department  of  Environment  formalize  its  agreement  with  its  service  provider  for  the 
Alberta  Emissions  Offset  Registry. 

Climate  change:  Error  correction  threshold — October  2009,  p.  50 

We  recommend  the  Department  of  Environment  establish  an  error  correction  threshold  that  considers  not  only 
the  percentages  of  emissions  or  production,  but  also  the  dollar  impact  on  the  Climate  Change  and  Emissions 
Management  Fund. 

Climate  change:  Cost-effectiveness  of  regulatory  processes — October  2009,  no.  5,  p.  51 

We  recommend  that  the  Department  of  Environment  assess  the  cost-effectiveness  of  the  Specified  Gas  Emitters 
Regulation. 

3+  Financial  security  for  land  disturbances — October  2009,  no.  23,  p.  207 
(repeated  two  times  since  October  1999) 

We  again  recommend  that  the  Department  of  Environment  implement  a system  for  obtaining  sufficient  financial 
security  to  ensure  parties  complete  the  conservation  and  reclamation  activity  that  the  Department  regulates 

Managing  Alberta's  Water  Supply:  Backlog  of  Water  Act  applications — April  2010,  no.  4,  p.  65 

We  recommend  that  the  Department  of  Environment  minimize  the  backlog  of  outstanding  applications  for  Wafer 
Act  licences  and  approvals. 
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Managing  Alberta’s  Water  Supply:  Assessing  compliance  with  the  Water  Act — April  2010,  no.  5,  p.  68 

We  recommend  that  the  Department  of  Environment  ensure  its  controls  provide  adequate  assurance  that 
performance  in  the  field  by  licence  and  approval  holders  as  well  as  others  complies  with  the  Water  Act. 

Managing  Alberta’s  Water  Supply:  Wetland  compensation — April  2010,  no.  6,  p.  71 

We  recommend  that  the  Department  of  Environment  formalize  its  wetland  compensation  relationships  and  control 
procedures. 

Managing  Alberta’s  Water  Supply:  Watershed  Planning  and  Advisory  Councils  grants  and  contracts — 

April  2010,  no.  7,  p.  73 

We  recommend  that  the  Department  of  Environment  strengthen  its  control  of  grants  and  contracts  with  Watershed 
Planning  and  Advisory  Councils. 

Management  has  identified  these  recommendations  as  implemented — to  be  confirmed  with  follow-up  audits: 

3+  Drinking  water:  Approvals  and  registrations — October  2006,  no.  1,  vol.  1,  p.  37 

We  recommend  that  the  Department  of  Environment  make  its  system  to  issue  approvals  and  registrations  more 
effective  by: 

• strengthening  supporting  processes  such  as  training,  manuals,  checklists,  and  quality  control  for  approvals 
and  registrations 

• ensuring  that  applications  are  complete  and  legislatively  compliant 

• documenting  important  decisions  in  the  application  and  registration  processes 

• processing  applications  and  conversions  promptly 

• maintaining  consistency  in  the  wording  of  approvals  and  registrations  across  the  province,  and 

• following  up  short-term  conditions  in  approvals 

3+  Drinking  water:  Inspection  system — October  2006,  no.  2,  vol.  1,  p.  43 

We  recommend  that  the  Department  of  Environment  improve  its  drinking  water  inspection  processes  by: 

• applying  the  same  inspection  frequency  targets  to  all  waterworks  regulated  by  the  Environmental  Protection 
and  Enhancement  Act 

• ensuring  inspectors  receive  sufficient  training  in  waterworks  systems  and  operations 

• revising  documentation  tools  and  practices,  including  making  them  more  risk  focused,  and 

• informing  operators  promptly  of  inspection  results,  ensuring  operators  respond  appropriately  and  concluding 
on  each  inspection 

Drinking  water:  Communicating  with  partners — October  2006,  vol.  1,  p.  48 

We  recommend  that  the  Department  of  Environment  at  the  district  level  expand  its  communication  with  partners 
involved  in  drinking  water  matters. 

3+  Drinking  water:  Information  systems — October  2006,  no.  4,  vol.  1,  p.  52 

We  recommend  that  the  Department  of  Environment  improve  the  information  systems  used  to  manage  its  drinking 
water  businesses  by: 

• updating  the  Environmental  Management  System  forms  and  improving  reporting  capacity 

• coordinating  regional,  district,  and  personal  information  systems  to  avoid  overlap  and  encourage  best 
practice,  and 

• using  data  to  improve  program  effectiveness  and  efficiency 

3+  Drinking  water:  Supporting  drinking  water  goals — October  2006,  no.  5,  vol.  1,  p.  55 

We  recommend  that  the  Department  of  Environment  ensure  that  its  legislation,  programs,  and  practices  support  its 
new  drinking  water  goals.  This  includes: 

• clarifying  how  approvals  will  move  facilities  towards  current  standards 

• delivering  central  initiatives  that  enhance  the  drinking  water  program 

• determining  how  the  Department  should  promote  policy  initiatives  such  as  regionalization,  including  the 
financing  of  those  initiatives 

• establishing  how  the  Department  can  partner  with  others  while  mitigating  the  risks  inherent  in  partnering,  and 

• reinforcing  a “beyond  compliance’’  mindset  with  Department  staff 

3+  Water  well  drilling — October  2006,  no.  28,  vol.  2,  p.  84 

We  recommend  that  the  Department  of  Environment  improve  its  system  to  regulate  water  well  drilling  by: 

• ensuring  that  drillers  and  drilling  companies  meet  approval  requirements 

• implementing  controls  to  ensure  that  water  well  drilling  reports  are: 

• received  on  time 

• complete  and  accurate,  and 

• accurately  entered  into  the  Groundwater  Information  System 

• obtaining  assurance  that  water  well  drilling  activities  in  the  field  meet  legislated  standards 
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Climate  change:  Planning — October  2008,  no.  9,  p.  97 

We  recommend  that  the  Ministry  of  Environment  improve  Alberta  s response  to  climate  change  by 

• establishing  overall  cnteria  for  selecting  climate-change  actions 

• creating  and  maintaining  a master  implementation  plan  for  the  actions  necessary  to  meet  the  emissions- 
intensity  target  for  2020  and  the  emissions-reduction  target  for  2050 

• corroborating — through  modeling  or  other  analysis — that  the  actions  chosen  by  the  Ministry  result  in  Alberta 
being  on  track  for  achieving  its  targets  for  2020  and  2050 

Improve  and  document  grant  monitoring  activities — October  2010,  no.  15,  p.  143 

We  recommend  that  the  Department  of  Environment  improve  its  monitoring  of  compliance  with  conditions  in  grant 
agreements  and  retain  evidence  of  the  review 

Clarify  what  are  valid  regulatory  expenses — October  2010,  p.  144 

We  recommend  that  the  Department  of  Environment  clarify  the  kind  and  extent  of  regulatory  expenses  that  can  be 
paid  out  of  the  Climate  Change  and  Emissions  Management  Fund 

Finance  and  Enterprise 

Ministry  and  Department 

The  following  recommendations  are  outstanding  and  not  yet  ready  for  follow-up  audits 

Obtaining  assurance  on  third  party  service  providers — October  2007,  vol.  2,  p.  87 

We  recommend  that  the  Tax  and  Revenue  Administration  Division  of  the  Ministry  of  Finance  ensure  that  controls 
over  Ministry  information  assets  hosted  or  administered  by  third  party  service  providers  are  documented  and 
operating  effectively. 

Oversight  of  financial  institutions:  Improve  accountability — April  2010,  no.  12,  p.  96 

We  recommend  that  the  Department  of  Finance  and  Enterprise  clarify  its  business  objectives  for  Alberta  Treasury 
Branches,  within  their  Memorandum  of  Understanding,  in  relation  to  the  level  of  risk  the  Department  expects 
Alberta  Treasury  Branches  to  take. 

Oversight  of  financial  institutions:  Completion  of  risk  assessments — April  2010,  p.  100 
We  recommend  that  the  Department  of  Finance  and  Enterprise  complete  risk  assessments  and  evaluate  the 
quality  of  the  regulated  entities'  risk  management  practices. 

Oversight  of  financial  institutions:  Monitoring  legislative  compliance — April  2010,  no.  14,  p.  101 

We  recommend  that  the  Department  of  Finance  and  Enterprise  strengthen  its  processes  to  ensure  identified 
legislative  non-compliance  matters  are  remediated. 

Oversight  of  financial  institutions:  Improve  transparency — April  2010,  p.  102 

We  recommend  that  the  Department  of  Finance  and  Enterprise: 

• clearly  identify  which  guidelines  and  supervisory  rules  are  applicable  for  the  regulated  entities 

• develop  processes  to  monitor  compliance  with  the  guidelines 

• assess  how  risks  are  mitigated  for  those  guidelines  and  supervisory  rules  that  are  not  applicable 

The  government’s  revenue  forecasting  system:  Improve  financial  reporting  processes — 

October  2010,  no.  16,  p.  150 

We  recommend  that  the  Department  of  Finance  and  Enterprise  improve  its  year-end  financial  reporting  processes 

Management  has  identified  these  recommendations  as  implemented — to  be  confirmed  with  follow-up  audits 

The  government’s  revenue  forecasting  system:  Rates  of  return  used  to  forecast  investment  income — 
October  2007,  vol.  1,  p.  142 

We  recommend  that  the  Department  of  Finance  incorporate  the  return  from  active  management  of  the  Alberta 
Heritage  Savings  Trust  Fund  in  the  forecast  of  investment  income. 

The  government’s  revenue  forecasting  system:  Personal  income  tax  forecast — October  2007,  vol.  1,  p.  143 

We  recommend  that  the  Department  of  Finance  improve  its  method  for  estimating  historical  personal  income 
growth  used  to  forecast  personal  income  tax  revenues. 

3+  The  government’s  revenue  forecasting  system:  Corporate  income  tax  forecast — 

October  2007,  no.  14,  vol.  1,  p.  145 

We  recommend  that  the  Department  of  Finance  improve  its  model  for  estimating  corporate  taxable  income 
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3+  The  government’s  revenue  forecasting  system:  Public  reporting  of  revenue  forecasts — 

October  2007,  no.  16,  vol.  1,  p.  149 

We  recommend  that  the  Department  of  Finance  enhance  the  public  reporting  of  revenue  forecasts  by: 

• explaining  the  difference  between  the  government’s  non-renewable  resource  revenue  forecast  and  those  of 
other  private  sector  forecasters 

• disclosing  investment  income  sensitivity  to  changes  in  rate  of  return  earned  on  equity  investments 

• explaining  the  expected  range  for  the  government’s  total  revenue  forecast  including  the  reasonability  of 
previous  forecasts 

User  access — October  2008,  p.  272 

We  recommend  that  the  Department  of  Finance  and  Enterprise  review  all  user  access  to  business  data  to  ensure 
that  unauthorized  changes  are  prevented  and  appropriate  incident  monitoring  exists  to  ensure  systems  issues  are 
promptly  resolved. 

Quality  control  process  over  review  of  information  in  the  annual  report — October  2009,  p.  214 

We  recommend  that  the  Department  of  Finance  and  Enterprise  improve  its  quality  control  review  process  over  the 
financial  statements  information  in  the  Ministry  annual  report. 

Contract  agreements — October  2009,  p.  216 

We  recommend  that  the  Department  of  Finance  and  Enterprise  have  signed  contract  agreements  in  place  before 
goods  or  services  are  supplied. 

Implementation  plan  for  regulatory  and  supervisory  frameworks — April  2010,  no.  13,  p.  97 

We  recommend  that  the  Department  of  Finance  and  Enterprise  develop  an  implementation  plan  for  its  approach  to 
regulating  and  supervising  regulated  financial  institutions. 

Alberta  Capital  Finance  Authority 

Management  has  identified  this  recommendation  as  implemented — to  be  confirmed  with  a follow-up  audit: 

Additional  skilled  resources  required — April  2009,  p.  103 

We  recommend  that  management  of  Alberta  Capital  Finance  Authority  secure  additional  skilled  resources  to 
help  implement  new  required  financial  accounting  standards  and  to  ensure  the  cost-effective  preparation  and 
management  review  of  its  annual  financial  statements. 

Alberta  Investment  Management  Corporation 

The  following  recommendations  are  outstanding  and  are  not  yet  ready  for  follow-up  audits: 

Access  and  change  management  controls — October  2007,  vol.  2,  p.  93 

We  recommend  that  the  Alberta  Investment  Management  Corporation  establish  access  and  change  management 
controls  for  its  investment-related  computer  information  systems. 

Internal  control  certification — October  2008,  no.  32,  p.  282 

We  recommend  that  the  Alberta  Investment  Management  Corporation  introduce  a process  to  prepare  to  internal 
control  certification  by: 

• ensuring  that  its  strategic  plan  includes  internal  control  certification 

• developing  a top-down,  risk-based  process  for  internal  control  design 

• selecting  an  appropriate  internal  control  risk-assessment  framework 

• considering  sub-certification  processes,  with  direct  reports  to  the  chief  executive  officer  and  chief  financial 
officer  providing  formal  certification  on  their  areas  of  responsibility 

• ensuring  that  management  compensation  systems  incorporate  the  requirement  for  good  internal  control 

• using  a phased  approach  to  assess  the  design  and  operating  effectiveness  of  internal  controls 

Help  clients  meet  financial  reporting  requirements — October  2010,  no.  17,  p.  156 

We  recommend  that  the  Alberta  Investment  Management  Corporation  identify  financial  reporting  requirements  in 
its  investment  management  agreements  with  clients.  The  Alberta  Investment  Management  Corporation  should 
meet  with  the  clients  to  understand  their  financial  reporting  frameworks,  their  financial  accounting  requirements 
and  the  investment-related  information  they  need  to  prepare  financial  statements. 

Improve  controls  over  investment  general  ledger — October  2010,  no.  18,  p.  157 

We  recommend  that  the  Alberta  Investment  Management  Corporation  implement  additional  control  procedures  so 
that  the  Corporation  itself  can  ensure  the  completeness  and  accuracy  of  its  Genvest  investment  general  ledger. 

Strengthen  information  technology  change  management  controls — October  2010,  p.  158 

We  recommend  that  the  Alberta  Investment  Management  Corporation  strengthen  its  information  technology 
change  management  controls  to  ensure  that  it  adequately  assesses  the  risks  of  changes,  and  does  not  make 
changes  outside  of  the  change  management  process. 
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Management  has  identified  these  recommendations  as  implemented — to  be  confirmed  with  follow-up  audits 

Coordination  with  the  Department  of  Finance  and  Enterprise — October  2009,  p.  235 

We  recommend  that  the  Alberta  Investment  Management  Corporation  work  with  the  Department  of  Finance  and 
Enterprise  to: 

• record  all  financial  statement  accounting  adjustments  in  the  investments  general  ledger  on  a timely  basis 

• coordinate  the  timing  of  private  investment  valuations  so  that  valuation  updates  to  the  investments  general 
ledger  are  entered  before  the  Department  performs  its  quarterly  write-down  analysis 

Financial  statements — October  2009,  p.  236 

We  recommend  that  the  Alberta  Investment  Management  Corporation  improve  its  processes  and  internal  controls 
to  achieve  completeness,  accuracy  and  increased  efficiency  in  financial  reporting 

Alberta  Treasury  Branches 

The  following  recommendations  are  outstanding  and  not  yet  ready  for  follow-up  audits 

Treasury  management:  Liquidity  simulations — October  2008,  p.  128 

We  recommend  that  Alberta  Treasury  Branches  further  expand  its  use  of  liquidity  simulations  as  a forward  looking 
liquidity  risk  measurement  tool  We  also  recommend  that  the  Asset  Liability  Committee  and  the  Board  Oversight 
Committee  consider  whether  the  results  of  liquidity  simulations  indicate  a need  to  modify  its  business  plan 

Treasury  management:  Interest  rate  risk  model  assumptions — October  2008,  p.  132 

We  recommend  that  Alberta  Treasury  Branches  improve  processes  for  creating,  applying  and  validating 
assumptions  used  in  its  interest  rate  risk  models. 

Treasury  management:  Interest  rate  risk  modeling  and  stress  testing — October  2008,  p.  134 

We  recommend  that  Alberta  Treasury  Branches  define  its  significant  interest  rate  risk  exposures  and  model  those 
significant  exposures  to  assess  the  effects  on  future  financial  results 

Treasury  management:  Interest  rate  risk  controls — October  2008,  p.  136 

We  recommend  that  Alberta  Treasury  Branches  put  in  place  controls  necessary  to  ensure  consistent  measurement 
of  interest  rate  risk. 

Treasury  management:  Role  and  use  of  middle  office — October  2008,  p.  137 

We  recommend  that  Alberta  Treasury  Branches  expand  the  role  of  its  middle  office'  to  include  responsibilities  for 
monitoring  interest  rate  risk.  We  also  recommend  that  management  ensure  the  middle  office  has  the  necessary 
resources  to  monitor  foreign  exchange  activities  and  fulfill  its  other  responsibilities 

Treasury  management:  Treasury  information  systems — October  2008,  p.  138 

We  recommend  that  Alberta  Treasury  Branches: 

• evaluate  its  current  treasury  information  systems  against  its  business  requirements 

• develop  and  implement  a treasury  information  technology  plan  to  upgrade  its  tools 

Treasury  management:  Treasury  policies — October  2008,  p.  139 

We  recommend  that  Alberta  Treasury  Branches  implement  the  updated  investment  and  derivatives  policies  for 
changes  arising  from  its  recent  review  of  those  policies.  We  also  recommend  that  Alberta  Treasury  Branches 
review  the  financial  risk  management  policy. 

Internal  control  weaknesses — October  2008,  no.  29,  p.  278 

We  recommend  that  Alberta  Treasury  Branches  validate  and  approve  business  processes  and  internal  control 
documentation  developed  by  its  internal  control  group  and  implement  plans  to  resolve  identified  internal  control 
weaknesses. 

Securitization  policy  and  business  rules — October  2008,  no.  31,  p.  280 

We  recommend  that  Alberta  Treasury  Branches  develop  and  implement  a securitization  policy  and  securitization 
business  rules. 

Internal  controls — October  2009,  p.  221 

We  recommend  that  the  Alberta  Treasury  Branches  Strategic  Steering  Committee  receive  the  appropriate 
assurance  from  the  project  leadership  team  that  the  organization's  control  objectives  have  been  satisfied  before 
the  user  acceptance  testing  phase  of  the  project  is  complete. 

Organization-wide  information  technology  oversight — October  2009,  no.  24,  p.  222 
We  recommend  that  Alberta  Treasury  Branches  improve  the  efficiency  and  effectiveness  of  its  computing 
environment  by  developing  a process  to  ensure  all  Alberta  Treasury  Branch  business  units  adopt  and  follow  an 
organization-wide  information  technology  governance  and  control  framework 
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Service  auditor  reports:  User  control  considerations — October  2009,  p.  227 

We  recommend  that  Alberta  Treasury  Branches  improve  its  processes  related  to  service  providers  by  ensuring  its 
business  areas: 

• receive  service  provider  audit  reports 

• review  service  provider  audit  reports  and  assess  the  impact  of  identified  internal  control  weaknesses 

• put  end-user  controls  in  place  to  complement  service  provider  controls 

Improve  internal  controls  over  fair  value  calculations — October  2010,  p.  154 
(repeated  once  since  October  2008) 

We  again  recommend  that  Alberta  Treasury  Branches  improve  controls  over  the  calculation  of  the  fair  value  for  its 
derivatives  and  securities  by: 

• implementing  a peer  review  and  approval  process  for  inputs  and  assumptions  used  in  the  valuation  models. 
Alternatively,  for  derivatives,  management  could  use  a benchmarking  process  to  assess  reasonability  of  its 
calculated  fair  values. 

• documenting  the  results  of  this  work  consistently 

Management  has  identified  this  recommendation  as  implemented — to  be  confirmed  with  a follow-up  audit: 

Improve  credit  monitoring — October  2010,  p.  153 
(repeated  once  since  October  2008) 

We  again  recommend  that  Alberta  Treasury  Branches  promptly  update  the  derivative  credit  limits  disclosed  in  the 
Daily  Derivative  Credit  Exposure  Report. 

Health  and  Wellness 

Ministry  and  Department 

The  following  recommendations  are  outstanding  and  not  yet  ready  for  follow-up  audits: 

Accountability  of  Alberta  Health  Services2  to  the  Minister  of  Health  and  Wellness — 

October  2004,  no.  23,  p.  197 

3+  We  again  recommend  that  the  Department  of  Health  and  Wellness  improve  accountability  of  Alberta  Health 
Services  to  the  Minister  by: 

• ensuring  performance  expectations  for  Alberta  Health  Services  are  explicit  and  accepted  by  Alberta  Health 
Services 

• reviewing  and  providing  feedback  to  Alberta  Health  Services  on  its’  progress  towards  meeting  expectations, 
and 

• taking  follow-up  actions,  including  rewards  and  sanctions,  to  improve  the  future  performance  of  Alberta  Health 
Services 

Accountability  for  health  care  costs:  Ministry  annual  report  results  analysis — 

October  2006,  no.  31,  vol.  2,  p.  116 

3+  We  recommend  that  the  Ministry  of  Health  and  Wellness  explain  and  quantify  annually — in  its  annual  report — key 
factors  affecting  health  care  costs. 

8— r Accountability  for  health  care  costs — Performance  measures — October  2006,  no.  32,  vol.  2,  p.  118 

We  recommend  that  the  Ministry  of  Health  and  Wellness  link  health  costs  to  outputs  for  the  Ministry  as  a whole — in 
J its  annual  report. 

3+  Analysis  of  physician  billing  information — October  2006,  no.  33,  vol.  2,  p.  120 
(repeated  once  since  October  2001) 

We  recommend  that  the  Department  of  Health  and  Wellness  strengthen  its  processes  to  analyze  and  investigate 
anomalies  in  physician  billing  information. 

3+  Information  technology  control  environment — October  2006,  no.  34,  vol.  2,  p.  123 
(repeated  twice  since  October  2002) 

We  again  recommend  that  the  Department  of  Health  and  Wellness  carry  out  a comprehensive  risk  assessment  of 
its  information  technology  environment,  and  develop  and  implement  an  information  technology  disaster  recovery 
plan. 

Unauthorized  network  connections — October  2007,  vol.  2,  p.  105 

We  recommend  that  the  Department  of  Health  and  Wellness  improve  its  procedures  to  enforce  and  monitor 
compliance  with  its  Information  Security  Policy. 

3 Effective  April  1 , 2009,  Alberta  Health  Services  was  established,  replacing  the  previous  health  authorities  along  with  the  Alberta  Cancer 

Board,  Alberta  Mental  Health  Board  and  the  Alberta  Alcohol  and  Drug  Abuse  Commission.  We  have  replaced  the  names  in  this  listing  of  the 
health  authorities  and  other  boards  which  received  the  original  recommendations  with  Alberta  Health  Services— the  organization  which  is  now 
responsible  for  implementing  these  recommendations 
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Implementing  the  Provincial  Mental  Health  Plan — The  accountability  framework — April  2008,  no  4.  p.  77 

We  recommend  that  the  Department  of  Health  and  Wellness  ensure  there  is  a complete  accountability  framework 
for  the  Provincial  Mental  Health  Plan  and  mental  health  services  in  Alberta 

Compliance  monitoring  activities — October  2008,  no.  35,  p.  300 

We  recommend  that  the  Department  of  Health  and  Wellness  complete  a comprehensive  risk  assessment  and 
develop  a risk  based  plan  to  improve  the  effectiveness  of  its  compliance-monitoring  activities 

Electronic  health  records:  Project  management — October  2009,  no.  7,  p.  75 

We  recommend  the  Department  of  Health  and  Wellness  execute  publicly  funded  electronic  health  record  projects 
and  initiatives  in  accordance  with  established  project  management  standards 

Electronic  health  records:  Monitoring  the  electronic  health  records — October  2009,  no.  8,  p.  78 

We  recommend  the  Department  of  Health  and  Wellness  proactively  monitor  access  to  the  portal  (Netcare). 
through  which  the  electronic  health  records  can  be  viewed,  reviewing  it  for  potential  attacks,  breaches  and  system 
anomalies 

Electronic  health  records:  User  access  management — October  2009,  p.  80 

We  recommend  that  the  Department  of  Health  and  Wellness  ensure  that  its  user  access  management  policies  are 
followed  and  that  user  access  to  health  information  is  removed  when  access  privileges  are  no  longer  required 

Accountability  for  conditional  grants — October  2009,  p.  252 
(repeated  twice  since  October  2002) 

We  again  recommend  that  the  Department  of  Health  and  Wellness  improve  its  control  processes  to  ensure 
accountability  for  conditional  grants. 

Management  has  identified  this  recommendation  as  implemented — to  be  confirmed  with  a follow-up  audit 

Monitoring  infection  prevention  and  control  processes  (compliance  monitoring  activities) — 

October  2009,  p.  248 

We  recommend  that  the  Department  of  Health  and  Wellness  examine  and  clarify  the  role  of  its  Compliance 
Assurance  Branch  in  the  implementation  and  execution  of  infection  prevention  and  control  compliance  monitoring 
in  Alberta 

Health  and  Wellness  and  Agriculture  and  Rural  Development 

The  following  recommendations  are  outstanding  and  not  yet  ready  for  follow-up  audits 

3+  Food  Safety:  Integrated  food  safety  planning  and  activities — October  2009,  no.  11,  p.  107 
(repeated  once  since  October  2006) 

We  again  recommend  that  the  Departments  of  Health  and  Wellness  and  Agriculture  and  Rural  Development,  in 
cooperation  with  Alberta  Health  Services  and  federal  regulators,  improve  planning  and  coordination  of  food  safety 
activities  and  initiatives.  This  includes: 

• each  provincial  ministry  defining  its  own  food  safety  policies,  objectives  and  measures  (satisfactory  progress) 

• coordinating  provincial  food  safety  policies  and  planning  so  initiatives  are  integrated  (satisfactory  progress) 

• ensuring  provincial  approaches  align  with  initiatives  being  developed  through  federal/provincial/territorial 
committees  (satisfactory  progress) 

• improving  day-to-day  coordination  of  provincial  food  safety  activities 

• encouraging  the  joint  application  of  HACCP  and  HACCP  related  programs  in  Alberta,  and  (satisfactory 
progress) 

• improving  cooperation  and  working  relationships  among  provincial  and  federal  partners  such  as  the  First 
Nations  and  Inuit  Health  Branch  and  the  Canadian  Food  Inspection  Agency 

3+  Food  safety:  Accountability — October  2009,  no.  13,  p.  114 
(repeated  once  since  October  2006) 

We  again  recommend  that  the  Departments  of  Health  and  Wellness  and  Agriculture  and  Rural  Development 
improve  reporting  on  food  safety  in  Alberla. 

Health  and  Wellness,  Agriculture  and  Rural  Development  and  Alberta  Health  Services 

Management  has  identified  this  recommendation  as  implemented — to  be  confirmed  with  a follow-up  audit 

3+  Food  safety:  Eliminating  gaps  in  food  safety  inspection  coverage — October  2009,  no.  12,  p.  Ill 
(repeated  once  since  October  2006) 

We  again  recommend  that  Alberta  Health  Services  and  the  Departments  of  Health  and  Wellness  and  Agriculture 
and  Rural  Development,  working  with  federal  regulators,  eliminate  the  existing  gaps  in  food  safety  coverage  in 
Alberta  Gaps  include: 

• mobile  butchers 

• consistently  administering  the  Meat  Facility  Standard 

• coordinating  inspections  in  the  "non-federally  registered"  sector 
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Departments  of  Health  and  Wellness  and  Alberta  Health  Services 

The  following  recommendations  are  outstanding  and  not  yet  ready  for  follow-up  audits: 

3+  Seniors  care:  Effectiveness  of  services  in  long-term  care  facilities — October  2005,  no.  7,  p.  59 

We  recommend  that  the  Department  of  Health  and  Wellness  and  Alberta  Health  Services,  working  with  the 
Department  of  Seniors  and  Community  Supports,  assess  the  effectiveness  of  services  in  long-term  care  facilities. 

3+  Seniors  care:  Effectiveness  of  services  in  long-term  care  facilities — October  2005,  no.  8,  p.  59 

We  recommend  that  the  Department  of  Health  and  Wellness,  working  with  the  Department  of  Seniors  and 
Community  Supports,  collect  sufficient  information  about  facility  costs  from  Alberta  Health  Services  and  long-term 
care  facilities  to  make  accommodation  rate  and  funding  decisions. 

Implementing  the  Provincial  Mental  Health  Plan:  Implementation  systems — April  2008,  no.  3,  p.  72 

We  recommend  that  the  Department  of  Health  and  Wellness,  working  with  other  mental  health  participants, 
strengthen  implementation  of  the  Provincial  Mental  Health  Plan  by  improving: 

• implementation  planning 

• the  monitoring  and  reporting  of  implementation  activities  against  implementation  plans,  and 

• the  system  to  adjust  the  Plan  and  implementation  initiatives  in  response  to  changing  circumstances 

Mental  health:  Standards — October  2008,  no.  16,  p.  162 

We  recommend  that  the  Department  of  Health  and  Wellness  and  Alberta  Health  Services  create  provincial 
standards  for  mental  health  services  in  Alberta. 

Mental  health:  Funding,  planning,  and  reporting — October  2008,  p.  186 

We  recommend  that  the  Department  of  Health  and  Wellness  and  Alberta  Health  Services  ensure  the  funding, 
planning,  and  reporting  of  mental  health  services  supports  the  transformation  outlined  in  the  Provincial  Mental 
Health  Plan  as  well  as  system  accountability. 

Mental  health:  Aboriginal  and  suicide  priorities — October  2008,  p.  190 

We  recommend  that  the  Department  of  Health  and  Wellness  and  Alberta  Health  Services  consider  whether  the 
implementation  priority  for  aboriginal  and  suicide  issues  is  appropriate  for  the  next  provincial  strategic  mental 
health  plan. 

q r Electronic  health  records:  Oversight  and  accountability  for  electronic  health  records — 

October  2009,  no.  6,  p.  73 

We  recommend  that  the  Department  of  Health  and  Wellness  and  Alberta  Health  Services,  working  with  the 
Electronic  Health  Records  Governance  Committee,  improve  the  oversight  of  electronic  health  record  systems  by: 

• maintaining  an  integrated  delivery  plan  that  aligns  with  the  strategic  plan 

• improving  systems  to  regularly  report  costs,  timelines,  progress  and  outcomes 


Management  has  identified  these  recommendations  as  implemented — to  be  confirmed  with  follow-up  audits: 

Seniors  care:  Compliance  with  Basic  Service  Standards — October  2005,  no.  6,  p.  58 
We  recommend  that  the  Department  of  Health  and  Wellness  and  Alberta  Health  Services,  working  with  the 
3+  Department  of  Seniors  and  Community  Supports,  improve  the  systems  for  monitoring  the  compliance  of  long-term 
care  facilities  with  the  Basic  Service  Standards. 

Seniors  care:  Information  to  monitor  compliance  with  legislation — October  2005,  p.  61 

We  recommend  that  the  Department  of  Health  and  Wellness,  working  with  Alberta  Health  Services  and  the 
Department  of  Seniors  and  Community  Supports,  identify  the  information  required  from  long-term  care  facilities  to 
enable  the  Departments  and  Authorities  to  monitor  their  compliance  with  legislation. 

3+  Seniors  care:  Determining  future  needs  for  services  in  long-term  care  facilities — October  2005,  no.  9,  p.  62 
We  recommend  that  the  Department  of  Health  and  Wellness,  working  with  Alberta  Health  Services  and  the 
Department  of  Seniors  and  Community  Supports,  develop  a long-term  plan  to  meet  future  needs  for  services  in 
long-term  care  facilities.  We  also  recommend  that  the  Departments  publicly  report  on  progress  made  towards 
goals  in  the  plan. 

Seniors  care:  Determining  future  needs  for  services  in  long-term  care  facilities — October  2005,  p.  62 
We  recommend  that  the  Department  of  Health  and  Wellness  require  Alberta  Health  Services  to  periodically  update 
and  report  on  progress  implementing  their  ten  year  continuing  care  strategic  service  plans. 

Food  safety:  Tools  to  promote  and  enforce  food  safety — October  2006,  vol.  1,  p.  83 

We  recommend  that  Alberta  Health  Services  and  the  Department  of  Health  and  Wellness  consider  a wider  range  of 
tools  to  promote  and  enforce  food  safety. 
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Alberta  Health  Services 

The  following  recommendations  are  outstanding  and  not  yet  ready  for  follow-up  audits 

Mental  health:  Housing  and  supportive  living — October  2008,  no.  17,  p.  164 

We  recommend  that  Alberta  Health  Services  encourage  mental  health  housing  development  and  provide 
supportive  living  programs  so  mental  health  clients  can  recover  in  the  community 

Mental  health:  Concurrent  disorders — October  2008,  no.  18,  p.  168 

We  recommend  that  Alberta  Health  Services  strengthen  integrated  treatment  for  clients  with  severe  concurrent 
disorders  (mental  health  issues  combined  with  addiction  issues). 

Mental  health:  Not-for-profit  organizations — October  2008,  p.  169 

We  recommend  that  Alberta  Health  Services  improve  relationships  with  not-for-profit  organizations  to  provide 
better  coordinated  service  delivery. 

Mental  health:  Gaps  in  service — October  2008,  no.  19,  p.  171 

We  recommend  that  Alberta  Health  Services  reduce  gaps  in  mental  health  delivery  services  by  enhancing 

• mental  health  professionals  at  points  of  entry  to  the  system 

• coordinated  intake 

• specialized  programs  in  medium-sized  cities 

• transition  management  between  hospital  and  community  care 

Mental  health:  Provincial  coordination — October  2008,  p.  176 

We  recommend  that  Alberta  Health  Services  coordinate  mental  health  service  delivery  across  the  province  better 
by: 

• strengthening  inter-regional  coordination 

• implementing  standard  information  systems  and  data  sets  for  mental  health 

• implementing  common  operating  procedures 

• collecting  and  analyzing  data  for  evidence-based  evaluation  of  mental  health  programs 

Mental  health:  Community-based  service  delivery — October  2008,  p.  181 

We  recommend  that  Alberta  Health  Services  strengthen  service  delivery  for  mental  health  clients  at  regional  clinics 
by  improving: 

• wait  time  management 

• treatment  plans,  agreed  with  the  client 

• progress  notes 

• case  conferencing 

• file  closure 

• timely  data  capture  on  information  systems 

• client  follow  up  and  analysis  of  recovery 

Expense  claims  and  corporate  credit  cards  controls — October  2008,  p.  311 

We  recommend  that  Alberta  Health  Services  strengthen  and  follow  its  policies  and  processes  for  employee 
expense  claims  and  corporate  credit  cards.  We  also  recommend  that  Alberta  Health  Services  develop  and 
implement  policies  and  guidance  on  appropriate  expenses  for  hosting  and  working  sessions 

M t Food  safety:  Inspection  programs — October  2009,  no.  9,  p.  93 

(repeated  once  since  October  2006) 

3+  We  again  recommend  that  Alberta  Health  Services  improve  their  food  establishment  inspection  programs 
Specifically,  Alberta  Health  Services  should. 

• inspect  food  establishments  following  generally  accepted  inspection  frequency  standards 

• ensure  that  inspections  are  consistently  administered  and  documented 

• follow  up  critical  violations  promptly  to  ensure  that  food  establishments  have  corrected  those  violations 

• use  their  enforcement  powers  to  protect  Albertans  from  the  highest  risk  food  establishments  (satisfactory 
progress) 

3+  Food  safety:  Information  systems — October  2009,  no.  10,  p.  99 
(repeated  once  since  October  2006) 

We  again  recommend  that  Alberta  Health  Services,  supported  by  the  Department  of  Health  and  Wellness,  improve 
their  automated  food  safety  information  systems.  This  includes: 

• enhancing  system  management,  security,  and  access  control 

• ensuring  data  consistency 

• ensuring  that  service  level  agreements  are  in  place 

• developing  reporting  capacity  for  management  and.  accountability  purposes 
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Supplementary  retirement  plans — October  2009,  no.  28,  p.  260 

We  recommend  that  Alberta  Health  Services  review  existing  supplementary  retirement  plans  and: 

• understand  the  terms  and  conditions  for  each  plan 

• develop  clear  and  consistent  policies  and  processes  for  administering  them 

• obtain  actuarial  valuations,  using  appropriate  and  consistent  assumptions,  for  the  plans 

• understand  the  impact  of  funding  options 

• ensure  sufficient  funds  are  available  to  meet  plan  obligations 

Information  technology  control  policies  and  processes — October  2009,  no.  29,  p.  2623 
We  recommend  that  Alberta  Health  Services: 

• develop  an  information  technology  control  framework,  including  appropriate  risk  management  processes  and 
controls,  for  the  management  of  its  information  technology  resources 

• monitor  compliance  with  security  policies,  implementing  effective  change  management  processes  and 
improving  passwords  controls 

Capital  project  monitoring  systems — October  2009,  no.  32,  p.  271 

We  recommend  that  Alberta  Health  Services  improve  the  efficiency  and  effectiveness  of  its  financial  capital  project 
monitoring  and  reporting  systems  and  processes  by: 

• implementing  common  systems,  policies  and  procedures  to  track  and  monitor  key  financial  information 

• providing  relevant,  timely  and  accurate  information  to  Executive  Management  and  the  Audit  and  Finance 
Committee 

Expenditure  policies  and  approvals — October  2009,  p.  277 

We  recommend  that  Alberta  Health  Services  improve  the  efficiency  and  effectiveness  of  its  expense  approval 
controls  by: 

• developing  and  implementing  a clear  and  comprehensive  expenditure  approval  policy 

• automating  the  expenditure  controls  within  the  purchasing  system 

Approval  of  drug  purchases — October  2009,  p.  278 

We  recommend  that  Alberta  Health  Services  improve  controls  for  drug  purchases  by  ensuring  they  are  properly 
approved  and  duties  are  appropriately  segregated. 

Financial  operations  transition  plan — October  2010,  no.  19,  p.  164 

We  recommend  that  Alberta  Health  Services  prepare  and  implement  a formal  transition  plan  for  the  organization’s 
finance  operations.  The  plan  should  include  and  integrate  the  following: 

• assessing  the  resources,  timelines  and  critical  path  needed  to  consolidate  the  general  ledger  and  sub-ledger 
systems 

• ensuring  rigorous  change  management  controls  are  applied  before  implementing  application  system  changes 

• harmonizing  financial  reporting  policies  and  processes  across  the  organization 

• determining  the  adequate  amount  of  human  resources  and  skill  levels  required  to  implement  the  plan  and 
then  keep  the  processes  operational 

Effectiveness  of  insurance  reciprocal — October  2010,  no.  21,  p.  167 

We  recommend  that  Alberta  Health  Services  assess  the  effectiveness  of  its  arrangement  with  the  Liability  and 
Property  Insurance  Plan  as  a risk  management  tool,  and  assess  the  resulting  accounting  implications. 

Accounting  for  restricted  contributions — October  2010,  no.  22,  p.  168 

We  recommend  that  Alberta  Health  Services  implement  consistent  and  efficient  accounting  processes  for 
externally  restricted  contributions  to  assure  the  Alberta  Health  Services  Board  that  it  is  complying  with  the 
restrictions  attached  to  those  contributions. 

Year-end  financial  reporting  processes — October  2010,  no.  23,  p.  169 
(repeated  once  since  October  2009) 

We  again  recommend  that  Alberta  Health  Services  improve  its  year-end  financial  reporting  processes  by  improving 
processes  to  identify  and  resolve  key  accounting  risks  and  reporting  issues  on  a timely  basis. 


4 The  implementation  of  this  recommendation  will  also  implement  the  following  recommendations: 

• Calgary  Health  Region:  Inappropriate  user  access — October  2007,  vol.  2,  no  29,  p.  113 

• Alberta  Cancer  Board:  Controls  over  access  to  computer  applications — October  2007,  vol.  2,  p.  115 

• Alberta  Alcohol  and  Drug  Abuse  Commission:  General  computer  controls — October  2007,  vol.  2,  p.  116 

• Calgary  Health  Region:  Information  technology  change  management  controls — October  2008,  p.  306 

• Calgary  Health  Region:  Information  technology  user  access  management  controls — October  2008,  p.  307 

• Capital  Health:  Information  technology  security  controls — October  2008,  p.  308 

• Capital  Health  Authority:  Information  technology  change  management  controls — October  2008,  p.  309 

• Peace  Country  Health:  Information  technology  user  access — October  2008,  p 313 
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Management  has  identified  these  recommendations  as  implemented — to  be  confirmed  with  follow-up  audits 

Performance  measures  for  surgical  services — October  2001,  p.  135 

We  recommend  that  Alberta  Health  Services  establish  a comprehensive  set  of  outcome-based  performance 
measures  for  surgical  facility  services  and  incorporate  these  standards  of  performance  into  ongoing  monitoring  of 
contracted  facilities 

3+  Contracting  practices:  Internal  controls — November  2006,  no.  1,  p.  14 

We  recommend  that  Alberta  Health  Services  management  improve  controls  over  contracting  by 

• ensuring  adequate  segregation  of  duties  exists  over  the  contracting  process 

• monitoring  and  verifying  contractors'  compliance  with  contract  terms  and  conditions 

3+  Contracting  practices:  Board  governance — November  2006,  no.  3,  p.  17 

We  recommend  that  the  Board,  at  least  annually,  receive  reports  from  management  on  the  design  and 
effectiveness  of  the  Alberta  Health  Services  internal  controls 

Contract  documentation — October  2008,  p.  312 

We  recommend  that  Alberta  Health  Services  develop  and  implement  a sole-sourcing  policy  for  contracts  and 
ensure  that  sole-sourcing  is  clearly  documented  and  justified  We  also  recommend  Alberta  Health  Services — 
Peace  Country  Health  ensure  contract  amendments,  including  changes  to  deliverables,  are  documented  and 
agreed  to  by  both  parties 

Physician  recruitment  incentives — October  2009,  p.  279 

We  recommend  that  Alberta  Health  Services  improve  controls  for  physician  recruitment  incentives  by  developing 
and  implementing  a policy  that  identifies: 

• criteria  and  approvals  required  for  granting  loans,  income  guarantees  and  relocation  allowances 

• monitoring  and  collection  procedures  for  physician  loans 

Capital  project  funding  and  approval — October  2009,  no.  31,  p.  269 

We  recommend  that  Alberta  Health  Services: 

• obtain  appropriate  approval  from  the  Minister  of  Health  and  Wellness  and  secure  adequate  capital  funding 
before  starting  capital  projects  that  are  internally  funded  or  debt  financed 

• ensure  budgets  include  the  estimated  future  operating  costs  associated  with  new  capital 

_ Funding  agreements  for  capital  projects — October  2010,  no.  20,  p.  166 

We  recommend  that  Alberta  Health  Services  ensure  that  funding  agreements  are  signed  prior  to  commencement 
of  construction  of  capital  projects,  and  are  formally  amended  when  there  are  significant  changes  in  the  scope  of  a 
capital  project. 

Alberta  Health  Services,  Health  and  Wellness  and  Agriculture  and  Rural  Development 

Management  has  identified  these  recommendations  as  implemented — to  be  confirmed  with  follow-up  audits 

3+  Food  safety:  Eliminating  gaps  in  food  safety  inspection  coverage — October  2009,  no.  12,  p.  Ill 
(repeated  once  since  October  2006) 

We  again  recommend  that  Alberta  Health  Services  and  the  Departments  of  Health  and  Wellness  and  Agriculture 
and  Rural  Development,  working  with  federal  regulators,  eliminate  the  existing  gaps  in  food  safety  coverage  in 
Alberta.  Gaps  include: 

• mobile  butchers 

• consistently  administering  the  Meat  Facility  Standard 

• coordinating  inspections  in  the  “non-federally  registered"  sector 


Housing  and  Urban  Affairs 

Department 

Management  has  identified  this  recommendation  as  implemented — to  be  confirmed  with  a follow-up  audit 

Direct  rent  supplement  program  payments — October  2009,  p.  283 

We  recommend  that  the  Department  of  Housing  and  Urban  Affairs  improve  its  monitoring  processes  of  direct  rent 
supplement  payments  issued  by  management  bodies,  by  requiring  periodic  reviews  of  these  payments. 

Infrastructure 

Ministry 

The  following  recommendation  is  outstanding  and  not  yet  ready  for  a follow-up  audit 

Information  technology  risk — October  2009,  p.  287 

We  recommend  that  the  Ministry  of  Infrastructure  develop  and  implement  an  information  technology  risk 
management  framework 
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Departments  of  Infrastructure  and  Treasury  Board 

The  following  recommendation  is  outstanding  and  not  yet  ready  for  a follow-up  audit: 

Alberta  schools  alternative  procurement:  Transparency — April  2010,  no.  2,  p.  24 

We  recommend  that  the  Departments  of  Treasury  Board  and  Infrastructure  follow  their  own  guidance  to  publish  a 
value  for  money  report  upon  entering  into  a public  private  partnership  agreement. 

Management  has  identified  this  recommendation  as  implemented — to  be  confirmed  with  a follow-up  audit: 

Alberta  schools  alternative  procurement:  Challenging  and  supporting  assumptions — 

April  2010,  no.  1,  p.  22 

We  recommend  that  the  Departments  of  Treasury  Board  and  Infrastructure  improve  processes,  including  sensitivity 
analysis,  to  challenge  and  support  maintenance  costs  and  risk  valuations. 

International  and  Intergovernmental  Affairs 

Ministry 

The  following  recommendations  are  outstanding  and  not  yet  ready  for  a follow-up  audit: 

Evaluating  international  offices’  performance — October  2008,  p.  324 

We  recommend  that  the  Ministry  of  International  and  Intergovernmental  Relations  improve  the  processes 
management  uses  to  evaluate  the  performance  of  each  international  office. 

Ensuring  effective  information-system  controls — October  2008,  p.  326 

We  recommend  that  the  Ministry  of  International  and  Intergovernmental  Relations  obtain  assurance  that 
information-system  controls  are  effective  at  the  international  offices  and  that  relevant  Government  of  Alberta 
information  technology  policies  and  standards  are  being  met. 

Justice  and  Attorney  General 

Department 

The  following  recommendation  is  outstanding  and  not  yet  ready  for  a follow-up  audit: 

Access  controls — October  2009,  p.  295 

We  recommend  that  the  Department  of  Justice  obtain  assurance  that  organizations  provided  access  to  the  Justice 
On-line  Information  Network  are  following  the  Department’s  policies  and  procedures  for  granting  user  access. 

Management  has  identified  this  recommendation  as  implemented — to  be  confirmed  with  a follow-up  audit: 

Motor  vehicle  accident  program:  Clarifying  collection  steps — October  2009,  no.  33,  p.  293 

We  recommend  that  the  Department  of  Justice  clarify  the  collection  steps  for  judgments  assigned  to  it  under  the 
Motor  Vehicle  Accident  program. 

Office  of  the  Public  Trustee 

Management  has  identified  this  recommendation  as  implemented — to  be  confirmed  with  a follow-up  audit: 

New  vendor  set-up — October  2010,  no.  24,  p.  180 

We  recommend  that  the  Office  of  the  Public  Trustee  improve  controls  for  inputting  new  vendors  in  its  Public 
Trustee  Information  System. 

Recurring  payments — October  2010,  p.  180 

We  recommend  that  the  Office  of  the  Public  Trustee  improve  its  controls  for  issuing  and  stopping  recurring 
payments. 

Municipal  Affairs 

Department 

The  following  recommendation  is  outstanding  and  not  yet  ready  for  a follow-up  audit: 

ME  first!  program — October  2008,  no.  37,  p.  335 

We  recommend  that  the  Department  of  Municipal  Affairs  assess  the  effect  on  greenhouse  gas  emissions  of 
the  energy  savings  that  resulted  from  the  projects  funded  by  the  Department’s  ME  first!  program  and  that  the 
Department  report  the  lessons  learned  from  this  program  to  the  Departments  involved  in  creating  climate  change 
programs. 

Disaster  recovery  program — October  2009,  no.  34,  p.  301 

We  recommend  that  the  Department  of  Municipal  Affairs  improve  its  management  of  the  disaster  recovery 
program  by: 

• setting  timelines  for  key  steps  that  must  be  performed  before  federal  government  funding  can  be  received 

• periodically  assessing  and  adjusting  costs  and  recovery  estimates  based  on  current  information 
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Management  has  identified  this  recommendation  as  implemented — to  be  confirmed  with  a follow-up  audit 

User  access  to  information  systems — October  2010,  p.  183 

We  recommend  that  the  Department  of  Municipal  Affairs  improve  its  procedures  for  granting  and  removing  user 
access  to  its  business  applications,  and  ensure  those  procedures  are  followed 

Seniors  and  Community  Supports 

Ministry  and  Department 

The  following  recommendations  are  outstanding  and  not  yet  ready  for  follow-up  audits 

3+  Seniors  care:  Effectiveness  of  Seniors  Lodge  Program — October  2005,  no.  12,  p.  66 

We  recommend  that  the  Department  of  Seniors  and  Community  Supports 
1 improve  the  measures  it  uses  to  assess  the  effectiveness  of  the  Seniors  Lodge  Program 
2.  obtain  sufficient  information  periodically  to  set  the  minimum  disposable  income  of  seniors  used  as  a basis  for 
seniors  lodge  rent  charges 

Seniors  care:  Determining  future  needs  for  Alberta  Seniors  Lodge  Program — October  2005,  p.  67 

We  recommend  that  the  Department  of  Seniors  and  Community  Supports  improve  its  processes  for  identifying  the 
increasing  care  needs  of  lodge  residents  and  consider  this  information  in  its  plans  for  the  Seniors  Lodge  Program 

General  computer  controls — October  2007,  vol.  2,  p.  143 

We  recommend  that  the  Ministry  of  Seniors  and  Community  Supports  improve  general  computer  controls  by 

• identifying  and  protecting  data  based  on  its  sensitivity 

• following  change  management  procedures 

• reviewing  database  logs,  and 

• reviewing  user  access  to  applications 

Persons  with  Developmental  Disabilities  Boards 

Management  has  identified  this  recommendation  as  implemented — to  be  confirmed  with  a follow-up  audit 

^ Contract  monitoring  and  evaluation — October  2004,  no.  9,  p.  Ill 

We  recommend  that  the  Persons  with  Developmental  Disabilities  Provincial  Board  work  with  the  six  Community 
3+  Boards  to  strengthen  the  monitoring  and  evaluation  of  the  performance  of  service  providers  by 

• requiring  individual  funding  service  providers  to  provide  adequate  financial  reporting 

• obtaining  annual  financial  statements  to  evaluate  the  financial  sustainability  of  critical  service  providers 

• implementing  a sustainable,  risk-based  internal  audit  plan 

• developing  and  implementing  standard  procedures  to  be  followed  when  Community  Board  staff  are  in  contact 
with  service  providers;  and 

• implementing  a method  to  evaluate  service  provider  performance 

Service  Alberta 

Ministry  and  Department 

The  following  recommendations  are  outstanding  and  not  yet  ready  for  follow-up  audits 

3+  Contracting  policies  and  procedures — October  2004,  no.  20,  p.  177 

We  recommend  that  the  Service  Alberta: 

• develop  comprehensive  contracting  policies  and  procedures 

• train  staff  on  how  to  follow  the  policies  and  procedures 

• monitor  staff  compliance  with  the  policies  and  procedures 

Information  technology  service  level  agreements  between  Service  Alberta  and  its  client  ministries — 
October  2007,  no.  32,  vol.  2,  p.  146 

3+  We  recommend  that  the  Ministry  of  Service  Alberta,  working  with  its  client  ministries,  revise  their  information 
technology  service  level  agreements  to: 

• ensure  that  the  agreements  are  current 

• clarify  the  level  of  services  provided  in  each  service  category 

• define  the  roles  and  responsibilities  of  each  party 

Guidance  to  implement  information  technology  control  frameworks — April  2008,  no.  7,  p.  170 

We  recommend  that  the  Ministry  of  Service  Alberta,  in  conjunction  with  all  ministries  and  through  the 
Information  Officer  Council,  develop  and  promote: 

• a comprehensive  information  technology  control  framework,  and  accompanying  implementation 
and 

• well-designed  and  cost-effective  information  technology  control  processes  and  activities 


Chief 
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Protecting  information  assets:  Central  security  office — October  2008,  no.  4,  p.  534 

To  secure  the  Government  of  Alberta's  information,  we  recommend  that  Service  Alberta  ensures  that  a central 
security  office  is  immediately  established  to  oversee  (develop,  communicate,  implement,  monitor  and  enforce) 
all  aspects  of  information  security  for  organizations  using  the  government's  shared  information-technology 
infrastructure. 

Protecting  information  assets:  Review  and  improve  the  Government  of  Alberta’s  shared  computing 
infrastructure  policies,  procedures,  and  standards — October  2008,  no.  6,  p.  68 

We  recommend  that  the  Ministry  of  Service  Alberta  work  with  all  ministries  and  through  the  Chief  Information 
Officer  Council,  to  develop  and  implement  policies,  procedures,  standards,  and  well-designed  control  activities  for 
the  Government  of  Alberta's  shared  computing  network. 

Protecting  information  assets:  Wireless  policies  and  standards — October  2008,  p.  75 

We  recommend  that  the  Ministry  of  Service  Alberta,  in  conjunction  with  all  ministries  and  through  the  Chief 
Information  Officer  Council,  update  its  existing  Wireless  LAN  Access  Security  Policy  to  provide  clearer  guidance  to 
ministries  in  deploying  and  securing  wireless-network-access  points. 

Protecting  information  assets:  Device  configurations — October  2008,  p.  76 

We  recommend  that  the  Ministry  of  Service  Alberta,  in  conjunction  with  all  ministries  and  through  the  Chief 
Information  Officer  Council,  review  the  configuration  of  laptops,  and  approve  policies  to  prevent  laptops  from 
inadvertently  exposing  the  government  environment. 

Protecting  information  assets:  Ongoing  monitoring  and  surveillance — October  2008,  no.  7,  p.  77 

We  recommend  the  Ministry  of  Service  Alberta,  in  conjunction  with  all  ministries  and  through  the  Chief  Information 
Officer  Council,  update  network  surveillance  methods  to  detect  and  investigate  the  presence  of  unauthorized 
wireless  access  points  within  the  Government  of  Alberta. 

Protecting  information  assets:  Backup  power  supplies — October  2008,  p.  85 

We  recommend  that  the  Ministry  of  Service  Alberta,  work  in  conjunction  with  all  ministries  and  through  the  Chief 
Information  Officer  Council,  to  ensure  that  ministries  that  use  data  facilities  ensure  that  connected  computer 
equipment  has  a sufficient  redundant  power  supply. 

Protecting  information  assets:  Physical  security — October  2008,  no.  8,  p.  87 

We  recommend  that  the  Ministry  of  Service  Alberta  work  with  the  Ministry  of  Infrastructure,  in  conjunction  with  all 
ministries  and  through  the  Chief  Information  Officer  Council,  to  improve: 

• physical  security  controls  at  data  facilities 

• logging  of  access  to  data  facilities  by  implementing  effective  controls  to  track  access 

Protecting  information  assets:  Environmental  security — October  2008,  p.  89 

We  recommend  that  Ministry  of  Service  Alberta  work  with  ministries  to  improve  the  environmental  security  controls 
at  shared  data  facilities. 

Service  Alberta’s  role  as  a central  processor  of  transactions — October  2008,  no.  38,  p.  345 

We  recommend  that  the  Ministry  of  Service  Alberta  consider  providing  internal  control  assurance  to  its  client 
ministries  on  its  centralized  processing  of  transactions. 

Access-  and  security-monitoring  of  application  systems — October  2008,  p.  346 

We  recommend  that  the  Ministry  of  Service  Alberta  ensure  adequate  logging  and  monitoring  processes  are  in 
place  in  all  application  systems  that  host  or  support  financial  information  and  Albertans'  personal  information. 

System-conversion  process — October  2008,  p.  349 

We  recommend  that  the  Ministry  of  Service  Alberta  document  its  review  of  actual  system-conversion  activities  to 
ensure  that  they  comply  with  the  approved  test  plan  for  system  conversion  and  data  migration. 

Information  technology  resumption  plan — October  2009,  no.  35,  p.  311 

We  recommend  that  the  Ministry  of  Service  Alberta  complete  and  test  an  information  technology  resumption  plan. 

Payroll  review  processes — October  2009,  p.  312 

We  recommend  that  the  Ministry  of  Service  Alberta  improve  its  process  to  provide  timely  supporting  documentation 
on  payroll  information  that  it  maintains  for  itself  and  its  client  ministries. 


5 Recommendation  originally  made  to  Executive  Council.  Both  entities  agreed  that  Service  Alberta  would  assume  responsibility  for  implementation. 
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Land  titles  registration  system:  Analyzing  land  titles  data — April  2010,  p.  110 

We  recommend  that  the  Department  of  Service  Alberta  improve  its  ability  to  detect  fraudulent  transactions  and 
mitigate  the  risk  of  property  fraud  by: 

• conducting  regular  analysis  of  land  title  data  for  suspicious  transactions 

• using  the  results  of  data  analysis  to  focus  investigations  and  prosecutions 

• providing  information  about  suspicious  activities  to  Department  staff  to  assist  them  in  the  exercise  of  their  new 
legislative  authority 

Protecting  information  assets:  Web  application  controls — October  2010,  no.  7,  p.  78 
(repeated  once  since  October  2008) 

We  again  recommend  that  Service  Alberta,  in  conjunction  with  all  ministries  and  through  the  Chief  Information 
Officer  Council,  develop  and  implement  well  designed  and  effective  controls  to  ensure  all  Government  of  Alberta 
web  applications  consistently  meet  all  security  standards  and  requirements 

Access  to  motor  vehicle  registration  data — October  2010,  p.  189 

We  recommend  that  the  Ministry  of  Service  Alberta  strengthen  its  control  over  granting  user  access  to  its  motor 
vehicles  system. 

Solicitor  General  and  Public  Security 

Department 

The  following  recommendations  are  outstanding  and  not  yet  ready  for  follow-up  audits 

Oversight  of  peace  officers:  Follow-up  of  compliance  audit  report  recommendations — 

April  2010,  no.  15,  p.  120 

We  recommend  that  the  Department  of  Solicitor  General  and  Public  Security  improve  its  processes  to  monitor  and 
ensure  employers  implement  its  compliance  audit  recommendations  by 

• developing,  maintaining  and  monitoring  a database  of  the  implementation  status  of  all  audit  recommendations 

• requiring  timely  written  confirmation  of  compliance  from  employers 

• ensuring  files  on  employers  are  properly  maintained 

• taking  necessary  and  timely  action  against  non-compliant  employers 

Oversight  of  peace  officers:  Processes  to  conduct  compliance  audits — April  2010,  p.  122 

We  recommend  that  the  Department  of  Solicitor  General  and  Public  Security 

• use  a risk-based  approach  in  future  audit  cycles  for  selecting  on-site  employer  compliance  audits 

• better  document  compliance  audit  files,  including  documenting  audit  findings,  identifying  auditors  performing 
the  work  and  demonstrating  sufficient  oversight 

Management  has  identified  this  recommendation  as  implemented — to  be  confirmed  with  a follow-up  audit 

Oversight  of  peace  officers:  Monitoring  employers'  investigations  of  peace  officers — 

April  2010,  no.  16,  p.  125 

We  recommend  that  the  Department  of  Solicitor  General  and  Public  Security  improve  monitoring  of  employers' 
investigations  of  complaints  made  against  peace  officers  by: 

• following  current  policy  and  best  practices,  including  managerial  approval  of  concluded  files,  and 
implementing  proper  filing  procedures 

• providing  written  notification  to  an  employer  when  closing  a file 

• better  maintaining  its  databases 

Sustainable  Resource  Development 
Department 

The  following  recommendations  are  outstanding  and  not  yet  ready  for  follow-up  audits 

Reforestation:  Monitoring  and  enforcement — October  2006,  no.  15,  vol.  1,  p.  122 

We  recommend  that  the  Department  of  Sustainable  Resource  Development  strengthen  its  monitoring  of 
3+  reforestation  activities  by: 

• bringing  more  rigour  to  the  review  of  forestry  operator  plans 

• making  its  field  inspection  program  more  effective 

• promptly  identifying  and  correcting  non-compliance  with  legislation 

Controls  over  revenue — October  2008,  no.  39,  p.  355 

We  recommend  that  the  Department  of  Sustainable  Resource  Development  put  processes  in  place  to  allow 
significant  revenues  currently  recorded  when  cash  is  received  to  be  recorded  when  revenue  is  due  to  the  Crown 
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Sand  and  gravel:  Enforcement  of  reclamation  obligations — October  2008,  no.  40,  p.  360 

We  recommend  that  the  Department  of  Sustainable  Resource  Development  improve  processes  for  inspecting 
aggregate  holdings  on  public  land  and  enforcing  land  reclamation  requirements. 

Sand  and  gravel:  Flat  fee  security  deposit — October  2008,  no.  41,  p.  362 

We  recommend  that  the  Department  of  Sustainable  Resource  Development  assess  the  sufficiency  of  security 
deposits  collected  under  agreements  to  complete  reclamation  requirements. 

Sand  and  gravel:  Quantity  of  aggregate  removed — October  2008,  p.  364 

We  recommend  that  the  Department  of  Sustainable  Resource  Development  develop  systems  to  verify  quantities 
of  aggregate  reported  as  removed  by  industry  from  public  lands  so  that  all  revenue  due  to  the  Crown  can  be 
assessed  and  recorded  in  the  financial  statements. 

Sand  and  gravel:  Information  management — October  2008,  p.  366 

We  recommend  that  the  Department  of  Sustainable  Resource  Development  capture  and  consolidate  information 
throughout  the  life  of  an  aggregate  holding  and  use  it  to  test  compliance  with  legal  obligations. 

3+  Reforestation:  Performance  information — April  2009,  no.  2,  p.  52 
(repeated  once  since  October  2006) 

We  again  recommend  that  the  Department  of  Sustainable  Resource  Development  publicly  report  relevant  and 
sufficient  reforestation  performance  information  to  confirm  the  effectiveness  of  its  regulatory  systems. 

Information  technology  control  framework — October  2009,  p.  323 

We  recommend  the  Department  of  Sustainable  Resource  Development  improve  policies  and  processes  in  its 
information  technology  control  environment. 

Management  has  identified  these  recommendations  as  implemented — to  be  confirmed  with  follow-up  audits: 

Leases  and  sales — October  2007,  vol.  2,  p.  161 

We  recommend  that  the  Department  of  Sustainable  Resource  Development  develop  a guideline  for  lease  and  sale 
of  land  indicating  when  and  with  whom  to  consult. 

Land  sale  agreements — October  2007,  vol.  2,  p.  162 

We  recommend  that  the  Department  of  Sustainable  Resource  Development  establish  a guideline  to  not  sell  public 
land  until  the  lessee  is  in  compliance  with  key  lease  requirements. 

3+  Requests  for  proposals — October  2007,  no.  33,  vol.  2,  p.  163 

We  recommend  that  the  Department  of  Sustainable  Resource  Development  evaluate  whether  government 
objectives  could  be  met  by  introducing  requests  for  proposals  from  all  interested  parties  whenever  an  entity  applies 
to  put  substantial  improvements  on  public  land. 

Tourism,  Parks  and  Recreation 

Ministry  and  Culture  and  Community  Spirit 

The  following  recommendation  is  outstanding  and  not  yet  ready  for  a follow-up  audit: 

Computer  control  environment — October  2007,  vol.  2,  p.  172 

We  recommend  that  the  Ministry  of  Tourism,  Parks,  Recreation  and  Culture5  work  with  Service  Alberta  to: 

• document  the  services  that  Service  Alberta  is  to  provide  and  its  control  environment  for  information  technology 

• implement  a process  to  ensure  that  Service  Alberta  consistently  meets  sen/ice  level  and  security  requirements 

• provide  evidence  that  control  activities  maintained  by  Service  Alberta  are  operating  effectively 

Transportation 

Ministry  and  Department 

The  following  recommendations  are  outstanding  and  not  yet  ready  for  follow-up  audits: 

3+  Commercial  and  motor  vehicle  inspection  programs — October  2004,  no.  29,  p.  301 

We  recommend  that  the  Ministry  of  Transportation  strengthen  its  monitoring  processes  for  Commercial  Vehicle 
Inspection  Program  and  Motor  Vehicle  Inspection  Program  by: 

• documenting  policies,  procedures  and  management’s  expectations  of  the  vehicle  safety  investigators  to 
ensure  that  they  perform  their  functions  appropriately  and  consistently 

• developing  a reporting  process  to  allow  senior  management  to  enhance  the  assessment  of  the  effectiveness 
of  the  programs 


6 Now  known  as  Culture  and  Community  Spirit. 


Report  of  the  Auditor  General  of  Alberta 


113 


April  2011 


Outstanding  Recommendations 


Commercial  vehicle  safety:  Inspection  tools  and  vehicle  selection — October  2009.  p.  124 

We  recommend  that  the  Department  of  Transportation  improve  its  inspection  capability  by  incorporating  risk 
analysis  into  the  selection  of  vehicles  for  roadside  inspection  and  increasing  the  amount  of  information  available  at 
roadside 

Commercial  vehicle  safety:  Progressive  sanctions — October  2009,  no.  14.  p.  127 

We  recommend  that  the  Department  of  Transportation  strengthen  enforcement  processes  relating  to.  or  arising 
from,  roadside  inspections. 

Commercial  vehicle  safety:  Analysis  and  measurement — October  2009,  no.  15,  p.  129 

We  recommend  that  the  Department  of  Transportation  further  develop  and  improve  its  data  analysis  practices  for 

use  in  program  delivery  and  performance  measure  reporting 

Information  technology  risk  assessment — October  2009,  p.  329 

We  recommend  that  the  Department  of  Transportation  develop  and  implement  an  information  technology  risk 
assessment  framework. 

Improve  processes  to  value  donated  assets  in  the  Department  financial  statements — October  2010,  p.  197 

We  recommend  that  the  Department  of  Transportation: 

• enter  into  agreements  with  donors  that: 

• provide  the  Department  of  Transportation  with  assurance  on  the  fair  value  of  the  donated  assets 

• specify  whether  donation  receipts  will  be  issued 

• document  its  support  for  the  valuation  reported  in  its  financial  statements,  including  the  procedures  performed, 
assumptions  made  and  source  documents  reviewed 

Management  has  identified  this  recommendation  as  implemented — to  be  confirmed  with  a follow-up  audit 

3+  Licensing  inspection  facilities  and  technicians — October  2004,  no.  30,  p.  303 

We  recommend  that  the  Ministry  of  Transportation  improve  the  process  to  license  inspection  facilities  and 
technicians. 

Treasury  Board 

Ministry  and  Department 

The  following  recommendations  are  outstanding  and  not  yet  ready  for  follow-up  audits: 

ri  Government  credit  cards — October  2007,  no.  17,  vol.  1,  p.  174 

We  recommend  that  the  Department  of  Treasury  Board,  working  with  all  other  departments,  further  improve 
3+  controls  for  the  use  of  government  credit  cards  by: 

1 . communicating  responsibilities  to  all  cardholders 

2.  clarifying  the  support  required  to  confirm  both  the  nature  and  purpose  of  transactions 

3.  providing  guidance  to  senior  financial  officers  and  accounting  staff  on  dealing  with  significant  non-compliance 

Inconsistent  budgeting  and  accounting  for  grants — October  2007,  vol.  2,  p.  178 

We  recommend  that  the  Ministry  of  Treasury  Board,  working  with  other  departments,  provide  guidance  to  ensure 
consistent  accounting  treatment  of  grants  throughout  government. 

Chief  executive  officer  compensation  disclosure — October  2008,  no.  3,  p.  32 

We  recommend  that  the  Treasury  Board  consider  applying  the  new  private-sector  compensation-disclosure 
requirement  to  the  Alberta  public  sector. 

Salary  and  benefits  disclosure — October  2008,  p.  371 

We  recommend  that  the  Ministry  of  Treasury  Board,  through  the  Salaries  and  Benefits  Disclosure  Directive,  clarify 
what  form  of  disclosure,  under  what  circumstances,  is  required  of  the  salary  and  benefits  of  an  individual  in  an 
organization's  senior  decision  making/management  group  who  is  compensated  directly  by  a third  party 

Report  on  selected  payments  to  Members  of  the  Legislative  Assembly — Efficiency — October  2008,  p.  376 

We  recommend  that  the  Department  of  Treasury  Board  use  current  technology  to  regularly  and  efficiently  compile 
the  material  for  public  reporting. 

Public  agencies:  Disclosure  of  termination  benefits  paid — October  2009,  no.  2,  p.  29 

We  recommend  that  the  Ministry  of  Treasury  Board  increase  transparency  of  termination  benefits  by  adopting 

disclosure  practices  for  Alberta  public  agencies  that  disclose  termination  benefits  paid 
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3+  Infrastructure  needs:  Deferred  maintenance — October  2010,  no.  8,  p.  89 
(repeated  once  since  October  2007) 

We  again  recommend  that  the  Department  of  Treasury  Board,  in  consultation  with  departments,  develop 
objectives,  timelines  and  targets  for  reducing  deferred  maintenance,  and  include  information  on  deferred 
maintenance  in  the  province’s  Capital  Plan. 

3+  Infrastructure  needs:  Maintaining  assets  over  their  life — October  2010,  no.  9,  p.  92 
(repeated  once  since  October  2007) 

We  again  recommend  that  the  Department  of  Treasury  Board  establish  a process  that  enables  public  infrastructure 
assets  to  be  properly  maintained  over  their  life. 

Management  has  identified  these  recommendations  as  implemented — to  be  confirmed  with  follow-up  audits: 

3+  Infrastructure  needs:  Process  to  prioritize  projects — October  2007,  no.  4,  vol.  1,  p.  57 

We  recommend  that  the  Department  of  Treasury  Board  improve  the  process  to  evaluate  proposed  infrastructure 
projects  that  ministries  submit. 

3+  Infrastructure  needs:  Improving  current  information — October  2007,  no.  5,  vol.  1,  p.  59 

We  recommend  that  the  Department  of  Treasury  Board,  working  with  the  Treasury  Capital  Planning  Committee, 
examine  how  the  current  information  provided  to  Treasury  Board  can  be  improved. 

Report  on  selected  payments  to  Members  of  the  Legislative  Assembly:  Timely — October  2008,  p.  377 

We  recommend  that  the  President  of  Treasury  Board  arrange  for  all  final  reviews  of  the  Report  of  Selected 
Payments  to  Members  and  Former  Members  of  the  Legislative  Assembly  and  Persons  Directly  Associated  with 
Members  of  the  Legislative  Assembly  to  take  place  within  six  months  of  the  year  end  so  that  the  Report  can  be 
ready  for  tabling  in  the  Legislative  Assembly. 

Government  of  Alberta  and  ministry  annual  reports:  Analysis  and  review  of  performance  measures — 
October  2009,  no.  16,  p.  136 

We  recommend  the  Ministry  of  Treasury  Board  work  with  ministries  to  improve  processes  at  the  ministry  level 
relating  to  analysis  and  review  of  performance  measures.  We  also  recommend  the  Ministry  of  Treasury  Board 
establish  a protocol  with  ministries  whereby  it  is  informed  of  proposed  changes  by  ministries  to  performance 
measures  methodology  in  a timely  manner. 

Departments  of  Treasury  Board  and  Infrastructure 

The  following  recommendation  is  outstanding  and  not  yet  ready  for  a follow-up  audit: 

Alberta  schools  alternative  procurement:  Transparency — April  2010,  no.  2,  p.  24 

We  recommend  that  the  Departments  of  Treasury  Board  and  Infrastructure  follow  their  own  guidance  to  publish  a 
value  for  money  report  upon  entering  into  a public  private  partnership  agreement. 

Management  has  identified  this  recommendation  as  implemented — to  be  confirmed  with  a follow-up  audit: 

Alberta  schools  alternative  procurement:  Challenging  and  supporting  assumptions — 

April  2010,  no.  1,  p.  22 

We  recommend  that  the  Departments  of  Treasury  Board  and  Infrastructure  improve  processes,  including  sensitivity 
analysis,  to  challenge  and  support  maintenance  costs  and  risk  valuations. 

Agency  Governance  Secretariat 

The  following  recommendations  are  outstanding  and  not  yet  ready  for  follow-up  audits: 

, Chief  executive  officer:  Guidance — October  2008,  no.  1,  p.  27 

We  recommend  that  the  Deputy  Minister  of  Executive  Council  through  the  Agency  Governance  Secretariat  assist 
agencies  and  departments  by  providing  guidance  in  the  areas  of  chief  executive  officer  selection,  evaluation  and 
compensation. 

Chief  executive  officer:  Accountability — October  2008,  no.  2,  p.  29 

We  recommend  the  Agency  Governance  Secretariat,  on  behalf  of  ministers,  annually  obtain  information  from 
agencies  on  chief  executive  officer  evaluation  and  compensation  processes  to  assess  if  good  practices  are  being 
consistently  followed.  The  results  of  these  systems  assessments  should  be  reported  to  ministers  who  should  then 
hold  boards  of  directors  accountable  for  their  decisions. 

Public  agencies:  Executive  compensation  practices — October  2009,  no.  1,  p.  23 

We  recommend  that  the  Deputy  Minister  of  Executive  Council,  through  the  Agency  Governance  Secretariat,  assist 
public  agencies  and  departments  by  providing  guidance  on  executive  compensation  practices  for  all  public  agency 
senior  executives. 
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Accountability 


Accrual  basis  of 
accounting 

Adverse  auditor’s 
opinion 

Assurance 

Attest  work,  attest 
audit 

Audit 

Auditor 

Auditor’s  opinion 
Auditor’s  report 
Business  cases 

Capital  asset 
COBIT 

Criteria 

Cross-ministry 

Crown 

Deferred 

contributions 


Responsibility  for  the  consequences  of  actions.  In  this  report,  accountability  requires  ministries, 
departments  and  other  entities  to: 

• report  their  results  (what  they  spent  and  what  they  achieved)  and  compare  them  to  their  goals 

• explain  any  differences  between  their  goals  and  results 

Government  accountability  allows  Albertans  to  decide  whether  the  government  is  doing  a good  job. 
They  can  compare  the  costs  and  benefits  of  government  action:  what  it  spends,  what  it  tries  to  do 
(goals),  and  what  it  actually  does  (results). 

Away  of  recording  financial  transactions  that  puts  revenues  and  expenses  in  the  period  when  they 
are  earned  and  incurred. 

An  auditor’s  opinion  that  financial  statements  are  not  presented  fairly  and  are  not  reliable. 


An  auditor’s  written  conclusion  about  something  audited.  Absolute  assurance  is  impossible  because 
of  several  factors,  including  the  nature  of  judgement  and  testing,  the  inherent  limitations  of  control, 
and  the  fact  that  much  of  the  evidence  available  to  an  auditor  is  only  persuasive,  not  conclusive. 

Work  an  auditor  does  to  express  an  opinion  on  the  reliability  of  financial  statements. 


An  auditor’s  examination  and  verification  of  evidence  to  determine  the  reliability  of  financial 
information,  to  evaluate  compliance  with  laws,  or  to  report  on  the  adequacy  of  management  systems, 
controls  and  practices. 

A person  who  examines  systems  and  financial  information. 

An  auditor’s  written  opinion  on  whether  things  audited  meet  the  criteria  that  apply  to  them. 

An  auditor’s  written  communication  on  the  results  of  an  audit. 

An  assessment  of  a project’s  financial,  social  and  economic  impacts.  A business  case  is  a proposal 
that  analyses  the  costs,  benefits  and  risks  associated  with  the  proposed  investment,  including 
reasonable  alternatives.  The  province  has  issued  business  case  usage  guidelines  and  a business 
case  template  that  departments  can  refer  to  in  establishing  business  case  policy. 

A long-term  asset. 

Abbreviation  for  “Control  Objectives  for  Information  and  Related  Technology."  COBIT  was  developed 
by  the  Information  Systems  Audit  and  Control  Foundation  and  the  IT  Governance  Institute.  COBIT 
provides  good  practices  for  managing  IT  processes  to  meet  the  needs  of  enterprise  management. 

It  bridges  the  gaps  between  business  risks,  technical  issues,  control  needs  and  performance 
measurement  requirements. 


Reasonable  and  attainable  standards  of  performance  that  auditors  use  to  assess  systems. 

The  section  of  this  report  covering  systems  and  problems  that  affect  several  ministries  or  the  whole 
government. 

The  Government  of  Alberta. 

See  “Restricted  contributions.” 
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Deferred 

maintenance 

Any  maintenance  work  not  performed  when  it  should  be  Maintenance  work  should  be  performed 
when  necessary  to  ensure  capital  assets  provide  acceptable  service  over  their  expected  lives 

ERP 

Abbreviation  for  Enterprise  Resource  Planning  ERPs  integrate  and  automate  all  data  and  processes 
of  an  organization  into  one  comprehensive  system.  A typical  ERP  has  multiple  modules  within  a 
computer  software  application,  standardized  hardware,  and  a centralized  database  used  by  all 
modules  to  achieve  this  integration  Although  an  ERP  can  be  as  small  as  an  accounting  and  payroll 
application,  the  term  ERP  is  usually  associated  with  larger  systems  that  perform  many  functions 
within  an  organization.  Examples  of  modules  in  an  ERP,  which  formerly  would  have  been  stand-alone 
applications,  include  Financials  (General  Ledger.  Accounts  Payable,  and  Accounts  Receivable), 
Payroll.  Human  Resources,  Purchasing  and  Supply  Chain.  Project  Management,  Asset  Management. 
Student  Administration  Systems  and  Decision  Support  Systems  Some  of  the  more  common  ERPs 
are  PeopleSoft.  SAP,  Great  Plains,  and  Oracle  Applications. 

Exception 

Something  that  does  not  meet  the  criteria  it  should  meet — see  "Auditor's  opinion  " 

Expense 

The  cost  of  a thing  over  a specific  time 

IFRS 

International  Financial  Reporting  Standards  (IFRS)  are  global  accounting  standards,  adopted  by  the 
Accounting  Standards  Board  of  the  Canadian  Institute  of  Chartered  Accountants  They  are  required 
for  government  business  enterprises  for  fiscal  years  beginning  on  or  after  January  1. 2011. 

GAAP 

Abbreviation  for  "generally  accepted  accounting  principles. ’ which  are  established  by  the  Canadian 
Institute  of  Chartered  Accountants. 

Governance 

A process  and  structure  that  brings  together  capable  people  and  relevant  information  to  achieve 
goals.  Governance  defines  an  organization's  accountability  systems  and  ensures  the  effective  use  of 
public  resources. 

Internal  audit 

A group  of  auditors  within  a ministry  (or  an  organization)  that  assesses  and  reports  on  the  adequacy 
of  the  ministry's  internal  controls.  The  group  reports  its  findings  directly  to  the  deputy  minister 
Internal  auditors  need  an  unrestricted  scope  to  examine  business  strategies;  internal  control  systems, 
compliance  with  policies,  procedures,  and  legislation;  economical  and  efficient  use  of  resources;  and 
the  effectiveness  of  operations. 

Internal  control 

A system  designed  to  provide  reasonable  assurance  that  an  organization  will  achieve  its  goals 
Management  is  responsible  for  an  effective  internal  control  system  in  an  organization,  and  the 
organization’s  governing  body  should  ensure  that  the  control  system  operates  as  intended  A control 
system  is  effective  when  the  governing  body  and  management  have  reasonable  assurance  that 

• they  understand  the  effectiveness  and  efficiency  of  operations 

• internal  and  external  reporting  is  reliable 

• the  organization  is  complying  with  laws,  regulations  and  internal  policies 

Management  letter 

Our  letter  to  the  management  of  an  entity  that  we  have  audited.  In  the  letter,  we  explain 

1.  our  work 

2.  our  findings 

3.  our  recommendation  of  what  the  entity  should  improve 

4.  the  risks  if  the  entity  does  not  implement  the  recommendation 

We  also  ask  the  entity  to  explain  specifically  how  and  when  it  will  implement  the  recommendation 

Material,  materiality 

Something  important  to  decision-makers. 

Misstatement 

A misrepresentation  of  financial  information  due  to  mistake,  fraud,  or  other  irregularities. 

Outcomes 

The  results  an  organization  tries  to  achieve  based  on  its  goals. 

Outputs 

The  goods  and  services  an  organization  actually  delivers  to  achieve  outcomes.  They  show  “how 
much"  or  "how  many.” 
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Performance 

measure 

Performance 

reporting 

Performance  target 

Qualified  auditor’s 
opinion 

Recommendation 


Restricted 

contributions 


Review 


Risk 

Risk  management 
Sample 


Standards  for 
systems  audits 

Systems 

(management) 

Systems 

(accounting) 


Indicator  of  progress  in  achieving  a goal. 


Reporting  on  financial  and  non-financial  performance  compared  to  plans. 


The  expected  result  for  a performance  measure. 

An  auditor’s  opinion  that  things  audited  meet  the  criteria  that  apply  to  them,  except  for  one  or  more 
specific  areas — which  cause  the  qualification. 

A solution  we — the  Office  of  the  Auditor  General  of  Alberta — propose  to  improve  the  use  of  public 
resources  or  to  improve  performance  reporting  to  Albertans. 

Restricted  contributions  are  monetary  receipts  or  gifts-in-kind  provided  with  stipulations  specified 
by  the  donor  or  grantor  on  how  those  resources  are  to  be  used  by  the  recipient  organization. 
Generally  accepted  accounting  principles  for  not-for-profit  organizations  require  externally  restricted 
contributions  to  be  accounted  for  by  including  the  value  of  contributions  in  revenue  only  after  the 
stipulations  are  met.  This  results  in  “deferred  contributions”  on  the  balance  sheet.  These  deferred 
contributions  represent  the  value  of  contributions  received  but  for  which  the  stipulations  have  not  yet 
been  met  by  the  recipient  organization.  Alternatively,  generally  accepted  accounting  principles  allow 
restricted  contributions  to  be  recognized  in  revenue  when  received  if  they  are  separately  classified  by 
the  nature  of  their  restrictions  on  the  face  of  the  financial  statements.  These  two  accounting  methods, 
known  as  the  deferral  method  and  restricted  fund  method,  are  thought  to  provide  useful  information 
to  readers  of  the  financial  statements  about  how  management  has  used  resources  provided  to  them 
and  whether  or  not  they  have  complied  with  stipulations  imposed  by  donors. 

Reviews  are  different  from  audits  in  that  the  scope  of  a review  is  less  than  that  of  an  audit  and 
therefore  the  level  of  assurance  is  lower.  A review  consists  primarily  of  enquiry,  analytical  procedures 
and  discussion  related  to  information  supplied  to  the  reviewer  with  the  objective  of  assessing  whether 
the  information  being  reported  on  is  plausible  in  relation  to  the  criteria. 

Anything  that  impairs  an  organization's  ability  to  achieve  its  goals. 

Identifying  and  then  minimizing  or  eliminating  risk  and  its  effects. 

A sample  is  a portion  of  a population.  We  use  sampling  to  select  items  from  a population.  We  perform 
audit  tests  on  the  sample  items  to  obtain  evidence  and  form  a conclusion  about  the  population  as  a 
whole.  We  use  either  statistical  or  judgemental  selection  of  sample  items,  and  we  base  our  sample 
size,  sample  selection,  and  evaluation  of  sample  results,  on  our  judgement  of  risk,  the  nature  of  the 
items  in  the  population,  and  the  specific  audit  objectives  for  which  sampling  is  being  used. 

Systems  audits  are  conducted  in  accordance  with  the  assurance  and  value-for-money  auditing 
standards  established  by  the  Canadian  Institute  of  Chartered  Accountants. 

A set  of  interrelated  management  control  processes  designed  to  achieve  goals  economically  and 
efficiently. 

A set  of  interrelated  accounting  control  processes  for  revenue,  spending,  the  preservation  or  use  of 
assets,  and  the  determination  of  liabilities. 
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Systems  audit 

To  help  improve  the  use  of  public  resources,  we  audit  and  recommend  improvements  to  systems 
designed  to  ensure  value  for  money. 

Paragraphs  (d)  and  (e)  of  subsection  19(2)  of  the  Auditor  General  Act  require  us  to  report  every  case 
in  which  we  observe  that 

• an  accounting  system  or  management  control  system,  including  those  designed  to  ensure 
economy  and  efficiency,  was  not  in  existence,  or  was  inadequate  or  not  complied  with,  or 

• appropriate  and  reasonable  procedures  to  measure  and  report  on  the  effectiveness  of  programs 
were  not  established  or  complied  with 

To  meet  this  requirement,  we  do  systems  audits.  Systems  audits  are  conducted  in  accordance  with 
the  auditing  standards  established  by  the  Canadian  Institute  of  Chartered  Accountants 

First,  we  develop  criteria  (the  standards)  that  a system  or  procedure  should  meet  We  always  discuss 
our  proposed  criteria  with  management  and  try  to  gain  their  agreement  to  them.  Then  we  do  our  work 
to  gather  audit  evidence.  Next,  we  match  our  evidence  to  the  criteria.  If  the  audit  evidence  matches 
all  the  criteria,  we  conclude  the  system  or  procedure  is  operating  properly  But  if  the  evidence  doesn't 
match  all  the  criteria,  we  have  an  audit  finding  that  leads  us  to  recommend  what  the  ministry  must  do 
to  ensure  that  the  system  or  procedure  will  meet  all  the  criteria  For  example,  if  we  have  five  criteria 
and  a system  meets  three  of  them,  the  two  unmet  criteria  lead  to  the  recommendation 

A systems  audit  should  not  be  confused  with  assessing  systems  with  a view  to  relying  on  them  in  an 
audit  of  financial  statements. 

Unqualified 
auditor’s  opinion 

An  auditor’s  opinion  that  information  audited  meet  the  criteria  that  apply  to  them. 

Unqualified  review 
engagement  report 

Although  sufficient  audit  evidence  has  not  been  obtained  to  enable  us  to  express  an  auditor's 
opinion,  nothing  has  come  to  our  attention  that  causes  us  to  believe  that  the  information  being 
reported  on  is  not,  in  all  material  respects,  in  accordance  with  appropriate  criteria 

Value  for  money 

The  concept  underlying  a systems  audit  is  value  for  money.  It  is  the  “bottom  line"  for  the  public  sector, 
analogous  to  profit  in  the  private  sector.  The  greater  the  value  added  by  a government  program,  the 
more  effective  it  is.  The  fewer  resources  that  are  used  to  create  that  value,  the  more  economical 
or  efficient  the  program  is.  “Value"  in  this  context  means  the  impact  that  the  program  is  intended 
to  achieve  or  promote  on  conditions  such  as  public  health,  highway  safety,  crime  or  farm  incomes 
To  help  improve  the  use  of  public  resources,  we  audit  and  recommend  improvements  to  systems 
designed  to  ensure  value  for  money. 

Other  resources 

The  Canadian  Institute  of  Chartered  Accountants  (CICA)  produces  a useful  book  called,  Terminology  for  Accountants  They 
can  be  contacted  at  CICA,  277  Wellington  Street  West,  Toronto,  Ontario,  Canada  M5V  3H2  or  www  cica  ca 
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